Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e4aebb03 authored by Ray Essick's avatar Ray Essick Committed by android-build-merger
Browse files

Merge \\\\\\\\\\\\"Fix corruption via buffer overflow in... 

Merge \\\\\\\\\\\\"Fix corruption via buffer overflow in mediaserver\\\\\\\\\\\\" into klp-dev am: b5299033 am: 357e0f13 am: efa12724 am: e20f434b am: 63b7b724 am: fbdd8670 am: b528c30f am: 998e71e1 am: 14a05e25 am: 18b498dc am: b0b2bbaf
am: 25d1b63b

Change-Id: Id5f04aafe8ffff6ea462c9696a3c477875a29fa8
parents 885dd713 25d1b63b

media/libstagefright/rtsp/ASessionDescription.cpp

+9 −5
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
//#define LOG_NDEBUG 0

#define LOG_TAG "ASessionDescription"

#include <utils/Log.h>

#include <cutils/log.h>



#include "ASessionDescription.h"
@@ -211,12 +212,12 @@ void ASessionDescription::getFormatType( 


    *PT = x;



    char key[20];

    sprintf(key, "a=rtpmap:%lu", x);

    char key[32];

    snprintf(key, sizeof(key), "a=rtpmap:%lu", x);



    CHECK(findAttribute(index, key, desc));



    sprintf(key, "a=fmtp:%lu", x);

    snprintf(key, sizeof(key), "a=fmtp:%lu", x);

    if (!findAttribute(index, key, params)) {

        params->clear();

    }
@@ -228,8 +229,11 @@ bool ASessionDescription::getDimensions( 
    *width = 0;

    *height = 0;



    char key[20];

    sprintf(key, "a=framesize:%lu", PT);

    char key[33];

    snprintf(key, sizeof(key), "a=framesize:%lu", PT);

    if (PT > 9999999) {

        android_errorWriteLog(0x534e4554, "25747670");

    }

    AString value;

    if (!findAttribute(index, key, &value)) {

        return false;