Merge "mpeg2ts: Handle bitstream shortfall errors gracefully" into main (f2ff8d4b) · Commits · e / os / android_frameworks_av

media/module/mpeg2ts/ATSParser.cpp

+153 −27

Original line number	Diff line number	Diff line
		@@ -440,6 +440,10 @@ bool ATSParser::Program::findCADescriptor(
		ATSParser::CADescriptor *caDescriptor) {
		bool found = false;
		while (infoLength > 2) {
		if (br->numBitsLeft() < 16) {
		ALOGE("Not enough data left in bitreader");
		return false;
		}
		unsigned descriptor_tag = br->getBits(8);
		ALOGV(" tag = 0x%02x", descriptor_tag);

		@@ -452,6 +456,10 @@ bool ATSParser::Program::findCADescriptor(
		}
		if (descriptor_tag == DESCRIPTOR_CA && descriptor_length >= 4) {
		found = true;
		if (br->numBitsLeft() < 32) {
		ALOGE("Not enough data left in bitreader");
		return false;
		}
		caDescriptor->mSystemID = br->getBits(16);
		caDescriptor->mPID = br->getBits(16) & 0x1fff;
		infoLength -= 4;
		@@ -460,14 +468,24 @@ bool ATSParser::Program::findCADescriptor(
		break;
		} else {
		infoLength -= descriptor_length;
		br->skipBits(descriptor_length * 8);
		if (!br->skipBits(descriptor_length * 8)) {
		ALOGE("Not enough data left in bitreader");
		return false;
		}
		}
		}
		br->skipBits(infoLength * 8);
		if (!br->skipBits(infoLength * 8)) {
		ALOGE("Not enough data left in bitreader");
		return false;
		}
		return found;
		}

		status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		if (br->numBitsLeft() < 10) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned table_id = br->getBits(8);
		ALOGV(" table_id = %u", table_id);
		if (table_id != 0x02u) {
		@@ -482,6 +500,10 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		}

		br->skipBits(1); // '0'
		if (br->numBitsLeft() < 86) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		MY_LOGV(" reserved = %u", br->getBits(2));

		unsigned section_length = br->getBits(12);
		@@ -526,6 +548,10 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {

		while (infoBytesRemaining >= 5) {
		StreamInfo info;
		if (br->numBitsLeft() < 40) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		info.mType = br->getBits(8);
		ALOGV(" stream_type = 0x%02x", info.mType);
		MY_LOGV(" reserved = %u", br->getBits(3));
		@@ -545,6 +571,10 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		info.mAudioPresentations.clear();
		bool hasStreamCA = false;
		while (ES_info_length > 2 && infoBytesRemaining >= 0) {
		if (br->numBitsLeft() < 16) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned descriptor_tag = br->getBits(8);
		ALOGV(" tag = 0x%02x", descriptor_tag);

		@@ -562,21 +592,39 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		if (descriptor_tag == DESCRIPTOR_DTS) {
		info.mType = STREAMTYPE_DTS;
		ES_info_length -= descriptor_length;
		br->skipBits(descriptor_length * 8);
		if (!br->skipBits(descriptor_length * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		} else if (descriptor_tag == DESCRIPTOR_CA && descriptor_length >= 4) {
		hasStreamCA = true;
		if (br->numBitsLeft() < 32) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		streamCA.mSystemID = br->getBits(16);
		streamCA.mPID = br->getBits(16) & 0x1fff;
		ES_info_length -= descriptor_length;
		descriptor_length -= 4;
		streamCA.mPrivateData.assign(br->data(), br->data() + descriptor_length);
		br->skipBits(descriptor_length * 8);
		if (!br->skipBits(descriptor_length * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		} else if (info.mType == STREAMTYPE_PES_PRIVATE_DATA &&
		descriptor_tag == DESCRIPTOR_DVB_EXTENSION && descriptor_length >= 1) {
		if (br->numBitsLeft() < 8) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned descTagExt = br->getBits(8);
		ALOGV(" tag_ext = 0x%02x", descTagExt);
		ES_info_length -= descriptor_length;
		descriptor_length--;
		if (br->numBitsLeft() < (descriptor_length * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		// The AC4 descriptor is used in the PSI PMT to identify streams which carry AC4
		// audio.
		if (descTagExt == EXT_DESCRIPTOR_DVB_AC4) {
		@@ -594,6 +642,10 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		br->skipBits(descriptor_length * 8);
		} else if (descTagExt == EXT_DESCRIPTOR_DVB_AUDIO_PRESELECTION &&
		descriptor_length >= 1) {
		if (br->numBitsLeft() < 8) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		// DVB BlueBook A038 Table 110
		unsigned num_preselections = br->getBits(5);
		br->skipBits(3); // reserved
		@@ -671,11 +723,17 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		info.mAudioPresentations.push_back(std::move(ap));
		}
		} else {
		br->skipBits(descriptor_length * 8);
		if (!br->skipBits(descriptor_length * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		}
		} else {
		ES_info_length -= descriptor_length;
		br->skipBits(descriptor_length * 8);
		if (!br->skipBits(descriptor_length * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		}
		}
		if (hasStreamCA && !mParser->mCasManager->addStream(
		@@ -694,6 +752,10 @@ status_t ATSParser::Program::parseProgramMap(ABitReader *br) {
		if (infoBytesRemaining != 0) {
		ALOGW("Section data remains unconsumed");
		}
		if (br->numBitsLeft() < 32) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned crc = br->getBits(32);
		if (crc != mPMT_CRC) {
		audioPresentationsChanged = true;
		@@ -1261,6 +1323,10 @@ void ATSParser::Stream::signalEOS(status_t finalResult) {
		status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		const uint8_t *basePtr = br->data();

		if (br->numBitsLeft() < 48) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned packet_startcode_prefix = br->getBits(24);

		ALOGV("packet_startcode_prefix = 0x%08x", packet_startcode_prefix);
		@@ -1286,10 +1352,14 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		&& stream_id != 0xff // program_stream_directory
		&& stream_id != 0xf2 // DSMCC
		&& stream_id != 0xf8) { // H.222.1 type E
		if (br->getBits(2) != 2u) {
		if (br->numBitsLeft() < 2 \|\| br->getBits(2) != 2u) {
		return ERROR_MALFORMED;
		}

		if (br->numBitsLeft() < 22) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned PES_scrambling_control = br->getBits(2);
		ALOGV("PES_scrambling_control = %u", PES_scrambling_control);

		@@ -1328,19 +1398,19 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		return ERROR_MALFORMED;
		}

		if (br->getBits(4) != PTS_DTS_flags) {
		if (br->numBitsLeft() < 7 \|\| br->getBits(4) != PTS_DTS_flags) {
		return ERROR_MALFORMED;
		}
		PTS = ((uint64_t)br->getBits(3)) << 30;
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 16 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		PTS \|= ((uint64_t)br->getBits(15)) << 15;
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 16 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		PTS \|= br->getBits(15);
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 1 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}

		@@ -1353,20 +1423,20 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		return ERROR_MALFORMED;
		}

		if (br->getBits(4) != 1u) {
		if (br->numBitsLeft() < 7 \|\| br->getBits(4) != 1u) {
		return ERROR_MALFORMED;
		}

		DTS = ((uint64_t)br->getBits(3)) << 30;
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 16 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		DTS \|= ((uint64_t)br->getBits(15)) << 15;
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 16 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		DTS \|= br->getBits(15);
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 1 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}

		@@ -1381,22 +1451,30 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		return ERROR_MALFORMED;
		}

		if (br->numBitsLeft() < 5) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		br->getBits(2);

		uint64_t ESCR = ((uint64_t)br->getBits(3)) << 30;
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 16 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		ESCR \|= ((uint64_t)br->getBits(15)) << 15;
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 16 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		ESCR \|= br->getBits(15);
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 1 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}

		ALOGV("ESCR = %" PRIu64, ESCR);
		if (br->numBitsLeft() < 10) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		MY_LOGV("ESCR_extension = %u", br->getBits(9));

		if (br->getBits(1) != 1u) {
		@@ -1411,18 +1489,25 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		return ERROR_MALFORMED;
		}

		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 1 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}
		if (br->numBitsLeft() < 22) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		MY_LOGV("ES_rate = %u", br->getBits(22));
		if (br->getBits(1) != 1u) {
		if (br->numBitsLeft() < 1 \|\| br->getBits(1) != 1u) {
		return ERROR_MALFORMED;
		}

		optional_bytes_remaining -= 3;
		}

		br->skipBits(optional_bytes_remaining * 8);
		if (!br->skipBits(optional_bytes_remaining * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}

		// ES data follows.
		int32_t pesOffset = br->data() - basePtr;
		@@ -1450,7 +1535,10 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		PTS_DTS_flags, PTS, DTS, PES_scrambling_control,
		br->data(), dataLength, pesOffset, event);

		br->skipBits(dataLength * 8);
		if (!br->skipBits(dataLength * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		} else {
		onPayloadData(
		PTS_DTS_flags, PTS, DTS, PES_scrambling_control,
		@@ -1465,15 +1553,13 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {
		payloadSizeBits / 8, pesOffset);
		}
		} else if (stream_id == 0xbe) { // padding_stream
		if (PES_packet_length == 0u) {
		if (PES_packet_length == 0u \|\| !br->skipBits(PES_packet_length * 8)) {
		return ERROR_MALFORMED;
		}
		br->skipBits(PES_packet_length * 8);
		} else {
		if (PES_packet_length == 0u) {
		if (PES_packet_length == 0u \|\| !br->skipBits(PES_packet_length * 8)) {
		return ERROR_MALFORMED;
		}
		br->skipBits(PES_packet_length * 8);
		}

		return OK;
		@@ -1481,6 +1567,10 @@ status_t ATSParser::Stream::parsePES(ABitReader br, SyncEvent event) {

		uint32_t ATSParser::Stream::getPesScramblingControl(
		ABitReader br, int32_t pesOffset) {
		if (br->numBitsLeft() < 24) {
		ALOGE("Not enough data left in bitreader!");
		return 0;
		}
		unsigned packet_startcode_prefix = br->getBits(24);

		ALOGV("packet_startcode_prefix = 0x%08x", packet_startcode_prefix);
		@@ -1491,6 +1581,7 @@ uint32_t ATSParser::Stream::getPesScramblingControl(
		}

		if (br->numBitsLeft() < 48) {
		ALOGE("Not enough data left in bitreader!");
		return 0;
		}

		@@ -1987,12 +2078,20 @@ void ATSParser::signalEOS(status_t finalResult) {
		}

		void ATSParser::parseProgramAssociationTable(ABitReader *br) {
		if (br->numBitsLeft() < 8) {
		ALOGE("Not enough data left in bitreader!");
		return;
		}
		unsigned table_id = br->getBits(8);
		ALOGV(" table_id = %u", table_id);
		if (table_id != 0x00u) {
		ALOGE("PAT data error!");
		return ;
		}
		if (br->numBitsLeft() < 56) {
		ALOGE("Not enough data left in bitreader!");
		return;
		}
		unsigned section_syntax_indictor = br->getBits(1);
		ALOGV(" section_syntax_indictor = %u", section_syntax_indictor);

		@@ -2009,9 +2108,17 @@ void ATSParser::parseProgramAssociationTable(ABitReader *br) {
		MY_LOGV(" section_number = %u", br->getBits(8));
		MY_LOGV(" last_section_number = %u", br->getBits(8));

		// check for unsigned integer overflow before assigning it to numProgramBytes
		if (section_length < 9) {
		return;
		}
		size_t numProgramBytes = (section_length - 5 /* header / - 4 / crc */);

		for (size_t i = 0; i < numProgramBytes / 4; ++i) {
		if (br->numBitsLeft() < 32) {
		ALOGE("Not enough data left in bitreader!");
		return;
		}
		unsigned program_number = br->getBits(16);
		ALOGV(" program_number = %u", program_number);

		@@ -2049,6 +2156,10 @@ void ATSParser::parseProgramAssociationTable(ABitReader *br) {
		}
		}

		if (br->numBitsLeft() < 32) {
		ALOGE("Not enough data left in bitreader!");
		return;
		}
		MY_LOGV(" CRC = 0x%08x", br->getBits(32));
		}

		@@ -2070,9 +2181,16 @@ status_t ATSParser::parsePID(
		section->clear();
		}

		if (br->numBitsLeft() < 8) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned skip = br->getBits(8);
		section->setSkipBytes(skip + 1); // skip filler bytes + pointer field itself
		br->skipBits(skip * 8);
		if (!br->skipBits(skip * 8)) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		}

		if (br->numBitsLeft() % 8 != 0) {
		@@ -2157,6 +2275,10 @@ status_t ATSParser::parsePID(
		status_t ATSParser::parseAdaptationField(
		ABitReader br, unsigned PID, unsigned random_access_indicator) {
		*random_access_indicator = 0;
		if (br->numBitsLeft() < 8) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned adaptation_field_length = br->getBits(8);

		if (adaptation_field_length > 0) {
		@@ -2227,6 +2349,10 @@ status_t ATSParser::parseAdaptationField(
		status_t ATSParser::parseTS(ABitReader br, SyncEvent event) {
		ALOGV("---");

		if (br->numBitsLeft() < 32) {
		ALOGE("Not enough data left in bitreader!");
		return ERROR_MALFORMED;
		}
		unsigned sync_byte = br->getBits(8);
		if (sync_byte != 0x47u) {
		ALOGE("[error] parseTS: return error as sync_byte=0x%x", sync_byte);