Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc5f1f5c authored by James Dong's avatar James Dong
Browse files

d263 may contain optional bitr box, and thus its size can be up to 23 bytes

bug - 3482703

Change-Id: Id6fdf9d1f4a304954c018b67d50bd79a07164687
parent 75a03f9a
Loading
Loading
Loading
Loading
+14 −7
Original line number Diff line number Diff line
@@ -1166,13 +1166,20 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {

        case FOURCC('d', '2', '6', '3'):
        {
            // d263 contains fixed 7 bytes:
            // vendor - 4 bytes
            // version - 1 byte
            // level - 1 byte
            // profile - 1 byte
            char buffer[7];
            if (chunk_data_size != (off64_t) sizeof(buffer)) {
            /*
             * d263 contains a fixed 7 bytes part:
             *   vendor - 4 bytes
             *   version - 1 byte
             *   level - 1 byte
             *   profile - 1 byte
             * optionally, "d263" box itself may contain a 16-byte
             * bit rate box (bitr)
             *   average bit rate - 4 bytes
             *   max bit rate - 4 bytes
             */
            char buffer[23];
            if (chunk_data_size != 7 &&
                chunk_data_size != 23) {
                LOGE("Incorrect D263 box size %lld", chunk_data_size);
                return ERROR_MALFORMED;
            }