diff options
author | Andreas Huber <andih@google.com> | 2010-02-16 10:46:02 -0800 |
---|---|---|
committer | Andreas Huber <andih@google.com> | 2010-02-16 10:46:02 -0800 |
commit | 0e917ec1e86477ca22ed8d5dc87a36f4641a6733 (patch) | |
tree | 38e3e425cd189720ca4ba8fd9c86f55d06692e7d /media/libstagefright/AMRExtractor.cpp | |
parent | 3cf7054398a9c0f2f15ce1cd189ed88de42e5ec3 (diff) | |
download | frameworks_av-0e917ec1e86477ca22ed8d5dc87a36f4641a6733.zip frameworks_av-0e917ec1e86477ca22ed8d5dc87a36f4641a6733.tar.gz frameworks_av-0e917ec1e86477ca22ed8d5dc87a36f4641a6733.tar.bz2 |
The AMRSource failed to properly release a media buffer in case of error.
related-to-bug: 2441307
Diffstat (limited to 'media/libstagefright/AMRExtractor.cpp')
-rw-r--r-- | media/libstagefright/AMRExtractor.cpp | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/media/libstagefright/AMRExtractor.cpp b/media/libstagefright/AMRExtractor.cpp index 3193d5e..2a16d26 100644 --- a/media/libstagefright/AMRExtractor.cpp +++ b/media/libstagefright/AMRExtractor.cpp @@ -225,27 +225,32 @@ status_t AMRSource::read( return ERROR_IO; } - MediaBuffer *buffer; - status_t err = mGroup->acquire_buffer(&buffer); - if (err != OK) { - return err; - } - if (header & 0x83) { // Padding bits must be 0. + LOGE("padding bits must be 0, header is 0x%02x", header); + return ERROR_MALFORMED; } unsigned FT = (header >> 3) & 0x0f; if (FT > 8 || (!mIsWide && FT > 7)) { + + LOGE("illegal AMR frame type %d", FT); + return ERROR_MALFORMED; } size_t frameSize = getFrameSize(mIsWide, FT); CHECK_EQ(frameSize, mFrameSize); + MediaBuffer *buffer; + status_t err = mGroup->acquire_buffer(&buffer); + if (err != OK) { + return err; + } + n = mDataSource->readAt(mOffset, buffer->data(), frameSize); if (n != (ssize_t)frameSize) { |