Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7095149 authored by Robert Shih's avatar Robert Shih
Browse files

AMPEG4ElementaryAssembler: erase malformed packets 

Bug: 124783982
Test: (1) python rtsp_serverTS.py $server_addr
Test: (2) adb shell am start -a android.intent.action.VIEW
  -n com.google.android.apps.photos/.pager.HostPhotoPagerActivity
  -t video/'*' -d rtsp://$server_addr/a.mp4
Change-Id: I7735eaa61ca4fd0d248a71d9604aae7f1c2e725f
parent 3ee398df

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp

+6 −0
Original line number Original line Diff line number Diff line
@@ -250,12 +250,16 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket( 
    } else {

    } else {

        // hexdump(buffer->data(), buffer->size());

        // hexdump(buffer->data(), buffer->size());

        if (buffer->size() < 2) {

        if (buffer->size() < 2) {

            android_errorWriteLog(0x534e4554, "124783982");

            queue->erase(queue->begin());

            return MALFORMED_PACKET;

            return MALFORMED_PACKET;

        }

        }





        unsigned AU_headers_length = U16_AT(buffer->data());  // in bits

        unsigned AU_headers_length = U16_AT(buffer->data());  // in bits





        if (buffer->size() < 2 + (AU_headers_length + 7) / 8) {

        if (buffer->size() < 2 + (AU_headers_length + 7) / 8) {

            android_errorWriteLog(0x534e4554, "124783982");

            queue->erase(queue->begin());

            return MALFORMED_PACKET;

            return MALFORMED_PACKET;

        }

        }
@@ -359,6 +363,8 @@ ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket( 
                return MALFORMED_PACKET;

                return MALFORMED_PACKET;

            }

            }

            if (buffer->size() < offset + header.mSize) {

            if (buffer->size() < offset + header.mSize) {

                android_errorWriteLog(0x534e4554, "124783982");

                queue->erase(queue->begin());

                return MALFORMED_PACKET;

                return MALFORMED_PACKET;

            }

            }