summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarco Nelissen <marcone@google.com>2017-02-13 14:19:40 -0800
committerSean McCreary <mccreary@mcwest.org>2017-04-05 19:38:58 -0600
commitdc7805b0c79d056385a076422894425984af2aa0 (patch)
treea3b1d6f33a5ce4a6e35070121320cf1872382ade
parent0836dbb870ff45470e595ec921fd5fab6e07d1ce (diff)
downloadframeworks_av-dc7805b0c79d056385a076422894425984af2aa0.zip
frameworks_av-dc7805b0c79d056385a076422894425984af2aa0.tar.gz
frameworks_av-dc7805b0c79d056385a076422894425984af2aa0.tar.bz2
resolve merge conflicts of 79cf158c51 to mnc-dev
AOSP-Change-Id: Ied32e83215e386c801c02991a0b2fa4baa25b643 CVE-2017-0558 (cherry picked from commit 50358a80b1724f6cf1bcdf003e1abf9cc141b122) Change-Id: Ic2e40c7d6aec8427444a1fd145726e490e994d08
-rw-r--r--media/libstagefright/wifi-display/rtp/RTPSender.cpp14
1 files changed, 10 insertions, 4 deletions
diff --git a/media/libstagefright/wifi-display/rtp/RTPSender.cpp b/media/libstagefright/wifi-display/rtp/RTPSender.cpp
index c66a898..83af393 100644
--- a/media/libstagefright/wifi-display/rtp/RTPSender.cpp
+++ b/media/libstagefright/wifi-display/rtp/RTPSender.cpp
@@ -762,10 +762,16 @@ status_t RTPSender::parseTSFB(const uint8_t *data, size_t size) {
return OK;
}
-status_t RTPSender::parseAPP(const uint8_t *data, size_t size __unused) {
- if (!memcmp("late", &data[8], 4)) {
- int64_t avgLatencyUs = (int64_t)U64_AT(&data[12]);
- int64_t maxLatencyUs = (int64_t)U64_AT(&data[20]);
+status_t RTPSender::parseAPP(const uint8_t *data, size_t size) {
+ static const size_t late_offset = 8;
+ static const char late_string[] = "late";
+ static const size_t avgLatencyUs_offset = late_offset + sizeof(late_string) - 1;
+ static const size_t maxLatencyUs_offset = avgLatencyUs_offset + sizeof(int64_t);
+
+ if ((size >= (maxLatencyUs_offset + sizeof(int64_t)))
+ && !memcmp(late_string, &data[late_offset], sizeof(late_string) - 1)) {
+ int64_t avgLatencyUs = (int64_t)U64_AT(&data[avgLatencyUs_offset]);
+ int64_t maxLatencyUs = (int64_t)U64_AT(&data[maxLatencyUs_offset]);
sp<AMessage> notify = mNotify->dup();
notify->setInt32("what", kWhatInformSender);