Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8370c7ad authored by Andreas Huber's avatar Andreas Huber
Browse files

Instead of asserting on malformed ADTS headers or insufficient data, 

stop decoding and signal a runtime error.

Change-Id: Ib66a17a2908273f65a92999951439cc6f0752164
related-to-bug: 6519161
parent 7c2af29e

media/libstagefright/codecs/aacdec/SoftAAC2.cpp

+43 −18
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 


#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/foundation/hexdump.h>

#include <media/stagefright/MediaErrors.h>



#define FILEREAD_MAX_LAYERS 2
@@ -336,8 +337,13 @@ void SoftAAC2::onQueueFilled(OMX_U32 portIndex) { 


            const uint8_t *adtsHeader = inHeader->pBuffer + inHeader->nOffset;



            CHECK_GE(inHeader->nFilledLen, 7);



            bool signalError = false;

            if (inHeader->nFilledLen < 7) {

                ALOGE("Audio data too short to contain even the ADTS header. "

                      "Got %ld bytes.", inHeader->nFilledLen);

                hexdump(adtsHeader, inHeader->nFilledLen);

                signalError = true;

            } else {

                bool protectionAbsent = (adtsHeader[1] & 1);



                unsigned aac_frame_length =
@@ -345,8 +351,14 @@ void SoftAAC2::onQueueFilled(OMX_U32 portIndex) { 
                    | (adtsHeader[4] << 3)

                    | (adtsHeader[5] >> 5);



            CHECK_GE(inHeader->nFilledLen, aac_frame_length);



                if (inHeader->nFilledLen < aac_frame_length) {

                    ALOGE("Not enough audio data for the complete frame. "

                          "Got %ld bytes, frame size according to the ADTS "

                          "header is %u bytes.",

                          inHeader->nFilledLen, aac_frame_length);

                    hexdump(adtsHeader, inHeader->nFilledLen);

                    signalError = true;

                } else {

                    adtsHeaderSize = (protectionAbsent ? 7 : 9);



                    inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize;
@@ -354,6 +366,19 @@ void SoftAAC2::onQueueFilled(OMX_U32 portIndex) { 


                    inHeader->nOffset += adtsHeaderSize;

                    inHeader->nFilledLen -= adtsHeaderSize;

                }



                if (signalError) {

                    mSignalledError = true;



                    notify(OMX_EventError,

                           OMX_ErrorStreamCorrupt,

                           ERROR_MALFORMED,

                           NULL);



                    return;

                }

            }

        } else {

            inBuffer[0] = inHeader->pBuffer + inHeader->nOffset;

            inBufferLength[0] = inHeader->nFilledLen;