diff options
author | Andreas Huber <andih@google.com> | 2012-12-06 10:42:29 -0800 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2012-12-06 10:42:29 -0800 |
commit | c984e76f3091c8210cd6bb0cae0f23549a7af0ee (patch) | |
tree | 7a729203b2fe316b1e29d75a76677701172fa158 | |
parent | e54cf26ae91d2e318a419d7e30445015d94fd487 (diff) | |
parent | 917279c99c7677a02a120909dc4f9092339f2827 (diff) | |
download | frameworks_av-c984e76f3091c8210cd6bb0cae0f23549a7af0ee.zip frameworks_av-c984e76f3091c8210cd6bb0cae0f23549a7af0ee.tar.gz frameworks_av-c984e76f3091c8210cd6bb0cae0f23549a7af0ee.tar.bz2 |
am 49c5737f: am 03425d9c: Merge "Fix bad checks that causes crash when streaming H.263 content."
* commit '49c5737fe4d9d82ea1cc71d7ca73edfc7477a401':
Fix bad checks that causes crash when streaming H.263 content.
-rw-r--r-- | media/libstagefright/rtsp/AAMRAssembler.cpp | 1 | ||||
-rw-r--r-- | media/libstagefright/rtsp/AH263Assembler.cpp | 30 |
2 files changed, 28 insertions, 3 deletions
diff --git a/media/libstagefright/rtsp/AAMRAssembler.cpp b/media/libstagefright/rtsp/AAMRAssembler.cpp index fb8abc5..9e8725a 100644 --- a/media/libstagefright/rtsp/AAMRAssembler.cpp +++ b/media/libstagefright/rtsp/AAMRAssembler.cpp @@ -145,7 +145,6 @@ ARTPAssembler::AssemblyStatus AAMRAssembler::addPacket( unsigned payloadHeader = buffer->data()[0]; unsigned CMR = payloadHeader >> 4; - CHECK_EQ(payloadHeader & 0x0f, 0u); // RR Vector<uint8_t> tableOfContents; diff --git a/media/libstagefright/rtsp/AH263Assembler.cpp b/media/libstagefright/rtsp/AH263Assembler.cpp index d0313cc..75cd911 100644 --- a/media/libstagefright/rtsp/AH263Assembler.cpp +++ b/media/libstagefright/rtsp/AH263Assembler.cpp @@ -13,6 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +//#define LOG_NDEBUG 0 +#define LOG_TAG "AH263Assembler" +#include <utils/Log.h> #include "AH263Assembler.h" @@ -100,11 +103,34 @@ ARTPAssembler::AssemblyStatus AH263Assembler::addPacket( } unsigned payloadHeader = U16_AT(buffer->data()); - CHECK_EQ(payloadHeader >> 11, 0u); // RR=0 unsigned P = (payloadHeader >> 10) & 1; unsigned V = (payloadHeader >> 9) & 1; unsigned PLEN = (payloadHeader >> 3) & 0x3f; - // unsigned PEBIT = payloadHeader & 7; + unsigned PEBIT = payloadHeader & 7; + + // V=0 + if (V != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded due to VRC (V != 0)"); + return MALFORMED_PACKET; + } + + // PLEN=0 + if (PLEN != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded (PLEN != 0)"); + return MALFORMED_PACKET; + } + + // PEBIT=0 + if (PEBIT != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded (PEBIT != 0)"); + return MALFORMED_PACKET; + } size_t skip = V + PLEN + (P ? 0 : 2); |