diff options
| author | Marco Nelissen <marcone@google.com> | 2016-06-08 14:31:42 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-06-23 15:05:17 -0700 |
| commit | 8e438e153f661e9df8db0ac41d587e940352df06 (patch) | |
| tree | 78300161723533706691d0890324d0c71c6ee63d | |
| parent | 590d1729883f700ab905cdc9ad850f3ddd7e1f56 (diff) | |
| download | frameworks_av-8e438e153f661e9df8db0ac41d587e940352df06.zip frameworks_av-8e438e153f661e9df8db0ac41d587e940352df06.tar.gz frameworks_av-8e438e153f661e9df8db0ac41d587e940352df06.tar.bz2 | |
SoftAAC2: fix crash on all-zero adts buffer
Bug: 29153599
Change-Id: I1cb81c054098b86cf24f024f8479909ca7bc85a6
| -rw-r--r-- | media/libstagefright/codecs/aacdec/SoftAAC2.cpp | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp index 520ecb4..8ddff90 100644 --- a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp +++ b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp @@ -625,12 +625,15 @@ void SoftAAC2::onQueueFilled(OMX_U32 /* portIndex */) { signalError = true; } else { adtsHeaderSize = (protectionAbsent ? 7 : 9); - - inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize; - inBufferLength[0] = aac_frame_length - adtsHeaderSize; - - inHeader->nOffset += adtsHeaderSize; - inHeader->nFilledLen -= adtsHeaderSize; + if (aac_frame_length < adtsHeaderSize) { + signalError = true; + } else { + inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize; + inBufferLength[0] = aac_frame_length - adtsHeaderSize; + + inHeader->nOffset += adtsHeaderSize; + inHeader->nFilledLen -= adtsHeaderSize; + } } } |