Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 606775f0 authored by Toni Heidenreich's avatar Toni Heidenreich Committed by Automerger Merge Worker
Browse files

[automerge] Fix Out of Bounds Read in AAVCAssembler 2p: 3066b141 am: 5a884e06 am: 17aac56e 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/20540194



Change-Id: Ida9eeb7ba48425e48f29db403dc455f747cdda55
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents aa48a7c9 17aac56e

media/libstagefright/rtsp/AAVCAssembler.cpp

+6 −2
Original line number Diff line number Diff line
@@ -332,6 +332,11 @@ void AAVCAssembler::checkIFrameProvided(const sp<ABuffer> &buffer) { 
}



bool AAVCAssembler::dropFramesUntilIframe(const sp<ABuffer> &buffer) {

    if (buffer->size() == 0) {

        ALOGE("b/230630526 buffer->size() == 0");

        android_errorWriteLog(0x534e4554, "230630526");

        return false;

    }

    const uint8_t *data = buffer->data();

    unsigned nalType = data[0] & 0x1f;

    if (!mFirstIFrameProvided && nalType < 0x5) {
@@ -624,8 +629,7 @@ int32_t AAVCAssembler::pickStartSeq(const Queue *queue, 
    int32_t firstSeqNo = buffer->int32Data();



    // This only works for FU-A type & non-start sequence

    int32_t nalType = buffer->size() >= 1 ? buffer->data()[0] & 0x1f : -1;

    if (nalType != 28 || (buffer->size() >= 2 && buffer->data()[1] & 0x80)) {

    if (buffer->size() < 2 || (buffer->data()[0] & 0x1f) != 28 || buffer->data()[1] & 0x80) {

        return firstSeqNo;

    }

media/libstagefright/rtsp/AHEVCAssembler.cpp

+3 −3
Original line number Diff line number Diff line
@@ -629,13 +629,13 @@ void AHEVCAssembler::submitAccessUnit() { 


int32_t AHEVCAssembler::pickStartSeq(const Queue *queue,

        uint32_t first, int64_t play, int64_t jit) {

    CHECK(!queue->empty());

    // pick the first sequence number has the start bit.

    sp<ABuffer> buffer = *(queue->begin());

    int32_t firstSeqNo = buffer->int32Data();



    // This only works for FU-A type & non-start sequence

    unsigned nalType = buffer->data()[0] & 0x1f;

    if (nalType != 28 || buffer->data()[2] & 0x80) {

    if (buffer->size() < 3 || (buffer->data()[0] & 0x1f) != 28 || buffer->data()[2] & 0x80) {

        return firstSeqNo;

    }
@@ -645,7 +645,7 @@ int32_t AHEVCAssembler::pickStartSeq(const Queue *queue, 
        if (rtpTime + jit >= play) {

            break;

        }

        if ((data[2] & 0x80)) {

        if (it->size() >= 3 && (data[2] & 0x80)) {

            const int32_t seqNo = it->int32Data();

            ALOGE("finding [HEAD] pkt. \t Seq# (%d ~ )[%d", firstSeqNo, seqNo);

            firstSeqNo = seqNo;