Merge "Fix bad checks that causes crash when streaming H.263 content." (f4283b68) · Commits · e / os / android_frameworks_av

media/libstagefright/rtsp/AAMRAssembler.cpp

+0 −1

Original line number	Diff line number	Diff line
		@@ -145,7 +145,6 @@ ARTPAssembler::AssemblyStatus AAMRAssembler::addPacket(

		unsigned payloadHeader = buffer->data()[0];
		unsigned CMR = payloadHeader >> 4;
		CHECK_EQ(payloadHeader & 0x0f, 0u); // RR

		Vector<uint8_t> tableOfContents;

+28 −2

Original line number	Diff line number	Diff line
		@@ -13,6 +13,9 @@
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/
		//#define LOG_NDEBUG 0
		#define LOG_TAG "AH263Assembler"
		#include <utils/Log.h>

		#include "AH263Assembler.h"

		@@ -100,11 +103,34 @@ ARTPAssembler::AssemblyStatus AH263Assembler::addPacket(
		}

		unsigned payloadHeader = U16_AT(buffer->data());
		CHECK_EQ(payloadHeader >> 11, 0u); // RR=0
		unsigned P = (payloadHeader >> 10) & 1;
		unsigned V = (payloadHeader >> 9) & 1;
		unsigned PLEN = (payloadHeader >> 3) & 0x3f;
		// unsigned PEBIT = payloadHeader & 7;
		unsigned PEBIT = payloadHeader & 7;

		// V=0
		if (V != 0u) {
		queue->erase(queue->begin());
		++mNextExpectedSeqNo;
		ALOGW("Packet discarded due to VRC (V != 0)");
		return MALFORMED_PACKET;
		}

		// PLEN=0
		if (PLEN != 0u) {
		queue->erase(queue->begin());
		++mNextExpectedSeqNo;
		ALOGW("Packet discarded (PLEN != 0)");
		return MALFORMED_PACKET;
		}

		// PEBIT=0
		if (PEBIT != 0u) {
		queue->erase(queue->begin());
		++mNextExpectedSeqNo;
		ALOGW("Packet discarded (PEBIT != 0)");
		return MALFORMED_PACKET;
		}

		size_t skip = V + PLEN + (P ? 0 : 2);