diff options
| author | Robert Shih <robertshih@google.com> | 2014-02-07 12:26:58 -0800 |
|---|---|---|
| committer | Robert Shih <robertshih@google.com> | 2014-03-21 19:05:17 +0000 |
| commit | 65e20ffc984c541a8119420f917493dd7b703f77 (patch) | |
| tree | 15d1d92e6b53cd32b1e7036359fe58841ff2d0d1 | |
| parent | a577eefbaca24d1b9ac947daca54be1992888748 (diff) | |
| download | frameworks_av-65e20ffc984c541a8119420f917493dd7b703f77.zip frameworks_av-65e20ffc984c541a8119420f917493dd7b703f77.tar.gz frameworks_av-65e20ffc984c541a8119420f917493dd7b703f77.tar.bz2 | |
DO NOT MERGE: PlaylistFetcher: fix infinite loop when parsing ADTS.
First check for embedded ID3 tag, then bail out if invalid.
Bug: 12934795
Change-Id: I74acebed4bfb2c6ca44dfe936166fdba8510233f
| -rw-r--r-- | media/libstagefright/httplive/PlaylistFetcher.cpp | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/media/libstagefright/httplive/PlaylistFetcher.cpp b/media/libstagefright/httplive/PlaylistFetcher.cpp index ada856d..668cbd4 100644 --- a/media/libstagefright/httplive/PlaylistFetcher.cpp +++ b/media/libstagefright/httplive/PlaylistFetcher.cpp @@ -1321,6 +1321,18 @@ status_t PlaylistFetcher::extractAndQueueAccessUnits( | (adtsHeader[4] << 3) | (adtsHeader[5] >> 5); + if (aac_frame_length == 0) { + const uint8_t *id3Header = adtsHeader; + if (!memcmp(id3Header, "ID3", 3)) { + ID3 id3(id3Header, buffer->size() - offset, true); + if (id3.isValid()) { + offset += id3.rawSize(); + continue; + }; + } + return ERROR_MALFORMED; + } + CHECK_LE(offset + aac_frame_length, buffer->size()); sp<ABuffer> unit = new ABuffer(aac_frame_length); |