Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6e73a4d authored by Presubmit Automerger Backend's avatar Presubmit Automerger Backend
Browse files

[automerge] Add missing bounds checks 2p: 2ebfe99b 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/19459610

Bug: 231986464
Change-Id: Id54c05625885817eee16d8ffa22c41e5aef8a3ad
Merged-In: Ie3494d592e7b36629317ba51717b528dab13e0fb
parents d727ba76 2ebfe99b

media/libstagefright/rtsp/AAVCAssembler.cpp

+4 −3
Original line number Diff line number Diff line
@@ -618,13 +618,14 @@ void AAVCAssembler::submitAccessUnit() { 


int32_t AAVCAssembler::pickStartSeq(const Queue *queue,

        uint32_t first, int64_t play, int64_t jit) {

    CHECK(!queue->empty());

    // pick the first sequence number has the start bit.

    sp<ABuffer> buffer = *(queue->begin());

    int32_t firstSeqNo = buffer->int32Data();



    // This only works for FU-A type & non-start sequence

    unsigned nalType = buffer->data()[0] & 0x1f;

    if (nalType != 28 || buffer->data()[1] & 0x80) {

    int32_t nalType = buffer->size() >= 1 ? buffer->data()[0] & 0x1f : -1;

    if (nalType != 28 || (buffer->size() >= 2 && buffer->data()[1] & 0x80)) {

        return firstSeqNo;

    }
@@ -634,7 +635,7 @@ int32_t AAVCAssembler::pickStartSeq(const Queue *queue, 
        if (rtpTime + jit >= play) {

            break;

        }

        if ((data[1] & 0x80)) {

        if (it->size() >= 2 && (data[1] & 0x80)) {

            const int32_t seqNo = it->int32Data();

            ALOGE("finding [HEAD] pkt. \t Seq# (%d ~ )[%d", firstSeqNo, seqNo);

            firstSeqNo = seqNo;