Merge "Fix null-pointer-dereferences accessing the SampleTable" (d36122b4) · Commits · e / os / android_frameworks_av

media/libstagefright/MPEG4Extractor.cpp

+18 −0

Original line number	Diff line number	Diff line
		@@ -1414,6 +1414,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		case FOURCC('s', 't', 'c', 'o'):
		case FOURCC('c', 'o', '6', '4'):
		{
		if ((mLastTrack == NULL) \|\| (mLastTrack->sampleTable == NULL))
		return ERROR_MALFORMED;

		status_t err =
		mLastTrack->sampleTable->setChunkOffsetParams(
		chunk_type, data_offset, chunk_data_size);
		@@ -1429,6 +1432,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

		case FOURCC('s', 't', 's', 'c'):
		{
		if ((mLastTrack == NULL) \|\| (mLastTrack->sampleTable == NULL))
		return ERROR_MALFORMED;

		status_t err =
		mLastTrack->sampleTable->setSampleToChunkParams(
		data_offset, chunk_data_size);
		@@ -1445,6 +1451,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		case FOURCC('s', 't', 's', 'z'):
		case FOURCC('s', 't', 'z', '2'):
		{
		if ((mLastTrack == NULL) \|\| (mLastTrack->sampleTable == NULL))
		return ERROR_MALFORMED;

		status_t err =
		mLastTrack->sampleTable->setSampleSizeParams(
		chunk_type, data_offset, chunk_data_size);
		@@ -1514,6 +1523,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

		case FOURCC('s', 't', 't', 's'):
		{
		if ((mLastTrack == NULL) \|\| (mLastTrack->sampleTable == NULL))
		return ERROR_MALFORMED;

		*offset += chunk_size;

		status_t err =
		@@ -1529,6 +1541,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

		case FOURCC('c', 't', 't', 's'):
		{
		if ((mLastTrack == NULL) \|\| (mLastTrack->sampleTable == NULL))
		return ERROR_MALFORMED;

		*offset += chunk_size;

		status_t err =
		@@ -1544,6 +1559,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

		case FOURCC('s', 't', 's', 's'):
		{
		if ((mLastTrack == NULL) \|\| (mLastTrack->sampleTable == NULL))
		return ERROR_MALFORMED;

		*offset += chunk_size;

		status_t err =