diff options
| author | Joshua J. Drake <android-open-source@qoop.org> | 2015-04-09 00:46:42 -0500 |
|---|---|---|
| committer | Steve Kondik <steve@cyngn.com> | 2016-03-22 17:14:35 -0700 |
| commit | c27fc358c91ed67965243294387dfb5ce7cd7fbf (patch) | |
| tree | 9c5cabe2bdb9ac2604bbf6b9a6563b9a68df57e3 | |
| parent | d954486023aea49be22b53495166f40a028fdb67 (diff) | |
| download | frameworks_av-c27fc358c91ed67965243294387dfb5ce7cd7fbf.zip frameworks_av-c27fc358c91ed67965243294387dfb5ce7cd7fbf.tar.gz frameworks_av-c27fc358c91ed67965243294387dfb5ce7cd7fbf.tar.bz2 | |
MPEG4Extractor: still more NULL dereference fixes
When processing various FourCC values within MP4 media, mLastTrack is accessed
without first ensuring that a track has been encoutered. Check for NULL and
bail out instead of crashing.
Bug: 20139950
Change-Id: Ie16687024d17348f576a0e13bd60bd4d6898de91
| -rwxr-xr-x | media/libstagefright/MPEG4Extractor.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index c7c238e..2d2e8fb 100755 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -1980,6 +1980,9 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { return ERROR_IO; } + if (mLastTrack == NULL) + return ERROR_MALFORMED; + uint32_t type = ntohl(buffer); // For the 3GPP file format, the handler-type within the 'hdlr' box // shall be 'text'. We also want to support 'sbtl' handler type |