Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79cf158c authored by Marco Nelissen's avatar Marco Nelissen Committed by android-build-merger
Browse files

Merge "stagefright: parseApp check data boundary conditions" into klp-dev am:...

Merge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff0 am: 86bd734f am: 7902138f am: a23c9a47
am: f8a2e81b

Change-Id: I64518f5a3860f66d3e232589f8c9ef643e572053
parents a6b1816e f8a2e81b
Loading
Loading
Loading
Loading
+9 −3
Original line number Diff line number Diff line
@@ -765,9 +765,15 @@ status_t RTPSender::parseTSFB(const uint8_t *data, size_t size) {
}

status_t RTPSender::parseAPP(const uint8_t *data, size_t size) {
    if (!memcmp("late", &data[8], 4)) {
        int64_t avgLatencyUs = (int64_t)U64_AT(&data[12]);
        int64_t maxLatencyUs = (int64_t)U64_AT(&data[20]);
    static const size_t late_offset = 8;
    static const char late_string[] = "late";
    static const size_t avgLatencyUs_offset = late_offset + sizeof(late_string) - 1;
    static const size_t maxLatencyUs_offset = avgLatencyUs_offset + sizeof(int64_t);

    if ((size >= (maxLatencyUs_offset + sizeof(int64_t)))
            && !memcmp(late_string, &data[late_offset], sizeof(late_string) - 1)) {
        int64_t avgLatencyUs = (int64_t)U64_AT(&data[avgLatencyUs_offset]);
        int64_t maxLatencyUs = (int64_t)U64_AT(&data[maxLatencyUs_offset]);

        sp<AMessage> notify = mNotify->dup();
        notify->setInt32("what", kWhatInformSender);