diff options
author | Nick Kralevich <nnk@google.com> | 2015-08-18 09:57:24 -0700 |
---|---|---|
committer | Nick Kralevich <nnk@google.com> | 2015-08-18 09:57:24 -0700 |
commit | 2f3c04a4e92aabea09325cd6870d74a705d98dd8 (patch) | |
tree | 8b6d5fd08ebce7007ce4a41434bc21b402df9000 /media/libstagefright/MPEG4Extractor.cpp | |
parent | a1e462e5531db20d1dc70c3e24c82879a0a90870 (diff) | |
parent | 6035c811849a8475697268cf71b5cf923705abe8 (diff) | |
download | frameworks_av-2f3c04a4e92aabea09325cd6870d74a705d98dd8.zip frameworks_av-2f3c04a4e92aabea09325cd6870d74a705d98dd8.tar.gz frameworks_av-2f3c04a4e92aabea09325cd6870d74a705d98dd8.tar.bz2 |
resolved conflicts for merge of 6035c811 to lmp-dev
Change-Id: Icf911f31e207c4c658047f6bfe8088d697b04ed6
Diffstat (limited to 'media/libstagefright/MPEG4Extractor.cpp')
-rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 48 |
1 files changed, 40 insertions, 8 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 193e51b..bbd351a 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -4098,6 +4098,14 @@ status_t MPEG4Source::fragmentedRead( if ((!mIsAVC && !mIsHEVC)|| mWantsNALFragments) { if (newBuffer) { + if (!isInRange((size_t)0u, mBuffer->size(), size)) { + mBuffer->release(); + mBuffer = NULL; + + ALOGE("fragmentedRead ERROR_MALFORMED size %zu", size); + return ERROR_MALFORMED; + } + ssize_t num_bytes_read = mDataSource->readAt(offset, (uint8_t *)mBuffer->data(), size); @@ -4105,7 +4113,7 @@ status_t MPEG4Source::fragmentedRead( mBuffer->release(); mBuffer = NULL; - ALOGV("i/o error"); + ALOGE("i/o error"); return ERROR_IO; } @@ -4177,18 +4185,40 @@ status_t MPEG4Source::fragmentedRead( ssize_t num_bytes_read = 0; int32_t drm = 0; bool usesDRM = (mFormat->findInt32(kKeyIsDRM, &drm) && drm != 0); + void *data = NULL; + bool isMalFormed = false; if (usesDRM) { - num_bytes_read = - mDataSource->readAt(offset, (uint8_t*)mBuffer->data(), size); + if (mBuffer == NULL || !isInRange((size_t)0u, mBuffer->size(), size)) { + isMalFormed = true; + } else { + data = mBuffer->data(); + } } else { - num_bytes_read = mDataSource->readAt(offset, mSrcBuffer, size); + int32_t max_size; + if (mFormat == NULL + || !mFormat->findInt32(kKeyMaxInputSize, &max_size) + || !isInRange((size_t)0u, (size_t)max_size, size)) { + isMalFormed = true; + } else { + data = mSrcBuffer; + } } + if (isMalFormed || data == NULL) { + ALOGE("isMalFormed size %zu", size); + if (mBuffer != NULL) { + mBuffer->release(); + mBuffer = NULL; + } + return ERROR_MALFORMED; + } + num_bytes_read = mDataSource->readAt(offset, data, size); + if (num_bytes_read < (ssize_t)size) { mBuffer->release(); mBuffer = NULL; - ALOGV("i/o error"); + ALOGE("i/o error"); return ERROR_IO; } @@ -4202,16 +4232,18 @@ status_t MPEG4Source::fragmentedRead( size_t dstOffset = 0; while (srcOffset < size) { - bool isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize); + isMalFormed = !isInRange((size_t)0u, size, srcOffset, mNALLengthSize); size_t nalLength = 0; if (!isMalFormed) { nalLength = parseNALSize(&mSrcBuffer[srcOffset]); srcOffset += mNALLengthSize; - isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength); + isMalFormed = !isInRange((size_t)0u, size, srcOffset, nalLength) + || !isInRange((size_t)0u, mBuffer->size(), dstOffset, (size_t)4u) + || !isInRange((size_t)0u, mBuffer->size(), dstOffset + 4, nalLength); } if (isMalFormed) { - ALOGE("Video is malformed"); + ALOGE("Video is malformed; nalLength %zu", nalLength); mBuffer->release(); mBuffer = NULL; return ERROR_MALFORMED; |