Commit d0e524f5 authored Nov 16, 2021 by Santiago Seifert Committed by Android Build Coastguard Worker Dec 15, 2021

Prevent out-of-bounds read

Bug: 204077881
Test: See bug for PoC instructions.
Change-Id: Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac
Merged-In: Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac
(cherry picked from commit d55f55d2)
(cherry picked from commit cc538ed2)
Merged-In:Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac

parent fc120151

media/libstagefright/rtsp/AAVCAssembler.cpp

+4 −0

Original line number	Diff line number	Diff line
		@@ -295,6 +295,10 @@ ARTPAssembler::AssemblyStatus AAVCAssembler::addNALUnit(
		}

		void AAVCAssembler::checkSpsUpdated(const sp<ABuffer> &buffer) {
		if (buffer->size() == 0) {
		android_errorWriteLog(0x534e4554, "204077881");
		return;
		}
		const uint8_t *data = buffer->data();
		unsigned nalType = data[0] & 0x1f;
		if (nalType == 0x7) {