diff options
| author | Robert Shih <robertshih@google.com> | 2014-03-05 01:59:39 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2014-03-05 01:59:39 +0000 |
| commit | 7a0662afeba50b78f43ce24539230cace30c3cfd (patch) | |
| tree | 9372cdf46973972ab9557cf7501d2502449159d4 | |
| parent | da5de09fd031b06c143000fcfb2164a01615c7ff (diff) | |
| parent | bdc0609f8133517b8e051938ad66bac750be90b4 (diff) | |
| download | frameworks_av-7a0662afeba50b78f43ce24539230cace30c3cfd.zip frameworks_av-7a0662afeba50b78f43ce24539230cace30c3cfd.tar.gz frameworks_av-7a0662afeba50b78f43ce24539230cace30c3cfd.tar.bz2 | |
Merge "PlaylistFetcher: fix infinite loop when parsing ADTS."
| -rw-r--r-- | media/libstagefright/httplive/PlaylistFetcher.cpp | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/media/libstagefright/httplive/PlaylistFetcher.cpp b/media/libstagefright/httplive/PlaylistFetcher.cpp index 1a02e85..2649705 100644 --- a/media/libstagefright/httplive/PlaylistFetcher.cpp +++ b/media/libstagefright/httplive/PlaylistFetcher.cpp @@ -1220,6 +1220,18 @@ status_t PlaylistFetcher::extractAndQueueAccessUnits( | (adtsHeader[4] << 3) | (adtsHeader[5] >> 5); + if (aac_frame_length == 0) { + const uint8_t *id3Header = adtsHeader; + if (!memcmp(id3Header, "ID3", 3)) { + ID3 id3(id3Header, buffer->size() - offset, true); + if (id3.isValid()) { + offset += id3.rawSize(); + continue; + }; + } + return ERROR_MALFORMED; + } + CHECK_LE(offset + aac_frame_length, buffer->size()); sp<ABuffer> unit = new ABuffer(aac_frame_length); |