Commit e9598179 authored Jan 24, 2017 by Robert Shih Committed by Sean McCreary Mar 22, 2017

avc_utils: skip empty NALs from malformed bistreams

Avoid a CHECK and make it the decoder's repsonsibility to handle a
malformed bistream gracefully.

Bug: 34509901
Bug: 33137046
Test: StagefrightTest#testStagefright_bug_27855419_CVE_2016_2463

CVE-2017-0483

Change-Id: I2d94f8da63d65a86a9c711c45546e4c695e0f3b4
(cherry picked from commit 91fe76a1)
(cherry picked from commit 5cabe32a59f9be1e913b6a07a23d4cfa55e3fb2f)

parent 85473b3d

media/libstagefright/avc_utils.cpp

+4 −1

Original line number	Diff line number	Diff line
		@@ -454,7 +454,10 @@ bool IsAVCReferenceFrame(const sp<ABuffer> &accessUnit) {
		size_t nalSize;
		bool bIsReferenceFrame = true;
		while (getNextNALUnit(&data, &size, &nalStart, &nalSize, true) == OK) {
		CHECK_GT(nalSize, 0u);
		if (nalSize == 0u) {
		ALOGW("skipping empty nal unit from potentially malformed bitstream");
		continue;
		}

		unsigned nalType = nalStart[0] & 0x1f;