Merge "Don't crash for bitstream errors in AMPEG4ElementaryAssembler" into lmp-dev (a8143b2b) · Commits · e / os / android_frameworks_av

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp

+10 −5

Original line number	Original line	Diff line number	Diff line
	@@ -249,11 +249,15 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket(
	mPackets.push_back(buffer);		mPackets.push_back(buffer);
	} else {		} else {
	// hexdump(buffer->data(), buffer->size());		// hexdump(buffer->data(), buffer->size());
			if (buffer->size() < 2) {
			return MALFORMED_PACKET;
			}

	CHECK_GE(buffer->size(), 2u);
	unsigned AU_headers_length = U16_AT(buffer->data()); // in bits		unsigned AU_headers_length = U16_AT(buffer->data()); // in bits

	CHECK_GE(buffer->size(), 2 + (AU_headers_length + 7) / 8);		if (buffer->size() < 2 + (AU_headers_length + 7) / 8) {
			return MALFORMED_PACKET;
			}

	List<AUHeader> headers;		List<AUHeader> headers;

	@@ -342,7 +346,9 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket(
	it != headers.end(); ++it) {		it != headers.end(); ++it) {
	const AUHeader &header = *it;		const AUHeader &header = *it;

	CHECK_LE(offset + header.mSize, buffer->size());		if (buffer->size() < offset + header.mSize) {
			return MALFORMED_PACKET;
			}

	sp<ABuffer> accessUnit = new ABuffer(header.mSize);		sp<ABuffer> accessUnit = new ABuffer(header.mSize);
	memcpy(accessUnit->data(), buffer->data() + offset, header.mSize);		memcpy(accessUnit->data(), buffer->data() + offset, header.mSize);
	@@ -352,8 +358,6 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket(
	CopyTimes(accessUnit, buffer);		CopyTimes(accessUnit, buffer);
	mPackets.push_back(accessUnit);		mPackets.push_back(accessUnit);
	}		}

	CHECK_EQ(offset, buffer->size());
	}		}

	queue->erase(queue->begin());		queue->erase(queue->begin());
	@@ -400,6 +404,7 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::assembleMore(
	const sp<ARTPSource> &source) {		const sp<ARTPSource> &source) {
	AssemblyStatus status = addPacket(source);		AssemblyStatus status = addPacket(source);
	if (status == MALFORMED_PACKET) {		if (status == MALFORMED_PACKET) {
			ALOGI("access unit is damaged");
	mAccessUnitDamaged = true;		mAccessUnitDamaged = true;
	}		}
	return status;		return status;