diff options
author | Andreas Huber <andih@google.com> | 2012-12-06 10:39:00 -0800 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2012-12-06 10:39:00 -0800 |
commit | 49c5737fe4d9d82ea1cc71d7ca73edfc7477a401 (patch) | |
tree | 52a5aa296099e92bbc0d3da984df13f6048f0823 | |
parent | cd8d39e00fb7896e56318cc192978446e21d46b8 (diff) | |
parent | 03425d9cf7f22cf400c13cda60d3e91f0fd48d6e (diff) | |
download | frameworks_av-49c5737fe4d9d82ea1cc71d7ca73edfc7477a401.zip frameworks_av-49c5737fe4d9d82ea1cc71d7ca73edfc7477a401.tar.gz frameworks_av-49c5737fe4d9d82ea1cc71d7ca73edfc7477a401.tar.bz2 |
am 03425d9c: Merge "Fix bad checks that causes crash when streaming H.263 content."
* commit '03425d9cf7f22cf400c13cda60d3e91f0fd48d6e':
Fix bad checks that causes crash when streaming H.263 content.
-rw-r--r-- | media/libstagefright/rtsp/AAMRAssembler.cpp | 1 | ||||
-rw-r--r-- | media/libstagefright/rtsp/AH263Assembler.cpp | 30 |
2 files changed, 28 insertions, 3 deletions
diff --git a/media/libstagefright/rtsp/AAMRAssembler.cpp b/media/libstagefright/rtsp/AAMRAssembler.cpp index fb8abc5..9e8725a 100644 --- a/media/libstagefright/rtsp/AAMRAssembler.cpp +++ b/media/libstagefright/rtsp/AAMRAssembler.cpp @@ -145,7 +145,6 @@ ARTPAssembler::AssemblyStatus AAMRAssembler::addPacket( unsigned payloadHeader = buffer->data()[0]; unsigned CMR = payloadHeader >> 4; - CHECK_EQ(payloadHeader & 0x0f, 0u); // RR Vector<uint8_t> tableOfContents; diff --git a/media/libstagefright/rtsp/AH263Assembler.cpp b/media/libstagefright/rtsp/AH263Assembler.cpp index d0313cc..75cd911 100644 --- a/media/libstagefright/rtsp/AH263Assembler.cpp +++ b/media/libstagefright/rtsp/AH263Assembler.cpp @@ -13,6 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +//#define LOG_NDEBUG 0 +#define LOG_TAG "AH263Assembler" +#include <utils/Log.h> #include "AH263Assembler.h" @@ -100,11 +103,34 @@ ARTPAssembler::AssemblyStatus AH263Assembler::addPacket( } unsigned payloadHeader = U16_AT(buffer->data()); - CHECK_EQ(payloadHeader >> 11, 0u); // RR=0 unsigned P = (payloadHeader >> 10) & 1; unsigned V = (payloadHeader >> 9) & 1; unsigned PLEN = (payloadHeader >> 3) & 0x3f; - // unsigned PEBIT = payloadHeader & 7; + unsigned PEBIT = payloadHeader & 7; + + // V=0 + if (V != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded due to VRC (V != 0)"); + return MALFORMED_PACKET; + } + + // PLEN=0 + if (PLEN != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded (PLEN != 0)"); + return MALFORMED_PACKET; + } + + // PEBIT=0 + if (PEBIT != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded (PEBIT != 0)"); + return MALFORMED_PACKET; + } size_t skip = V + PLEN + (P ? 0 : 2); |