diff options
author | Ricardo Cerqueira <ricardo@cyngn.com> | 2015-11-03 23:35:37 +0000 |
---|---|---|
committer | Ricardo Cerqueira <ricardo@cyngn.com> | 2015-11-03 23:35:37 +0000 |
commit | 2a4d9df8c969213f1942ea9f116293adbf41e2d3 (patch) | |
tree | ce8e8abdda03b1ed087b1bbfa88032159991af6a /media/libstagefright/Utils.cpp | |
parent | bdf2ad577d53139ec69e44b9cc8b8b90f8be330b (diff) | |
parent | 02103bb21c90abdca4e4ba91f7e3e007a82e01fd (diff) | |
download | frameworks_av-2a4d9df8c969213f1942ea9f116293adbf41e2d3.zip frameworks_av-2a4d9df8c969213f1942ea9f116293adbf41e2d3.tar.gz frameworks_av-2a4d9df8c969213f1942ea9f116293adbf41e2d3.tar.bz2 |
Merge tag 'android-6.0.0_r5' into HEAD
Android 6.0.0 release 5
Conflicts:
media/libstagefright/OggExtractor.cpp
media/libstagefright/Utils.cpp
Change-Id: I2ea44836c5cc3da8ffa2092522293c433bf7538c
Diffstat (limited to 'media/libstagefright/Utils.cpp')
-rw-r--r-- | media/libstagefright/Utils.cpp | 36 |
1 files changed, 28 insertions, 8 deletions
diff --git a/media/libstagefright/Utils.cpp b/media/libstagefright/Utils.cpp index d7b0bad..a29885f 100644 --- a/media/libstagefright/Utils.cpp +++ b/media/libstagefright/Utils.cpp @@ -219,8 +219,10 @@ status_t convertMetaDataToMessage( const uint8_t *ptr = (const uint8_t *)data; - CHECK(size >= 7); - CHECK_EQ((unsigned)ptr[0], 1u); // configurationVersion == 1 + if (size < 7 || ptr[0] != 1) { // configurationVersion == 1 + ALOGE("b/23680780"); + return BAD_VALUE; + } uint8_t profile __unused = ptr[1]; uint8_t level __unused = ptr[3]; @@ -246,7 +248,10 @@ status_t convertMetaDataToMessage( buffer->setRange(0, 0); for (size_t i = 0; i < numSeqParameterSets; ++i) { - CHECK(size >= 2); + if (size < 2) { + ALOGE("b/23680780"); + return BAD_VALUE; + } size_t length = U16_AT(ptr); ptr += 2; @@ -275,13 +280,19 @@ status_t convertMetaDataToMessage( } buffer->setRange(0, 0); - CHECK(size >= 1); + if (size < 1) { + ALOGE("b/23680780"); + return BAD_VALUE; + } size_t numPictureParameterSets = *ptr; ++ptr; --size; for (size_t i = 0; i < numPictureParameterSets; ++i) { - CHECK(size >= 2); + if (size < 2) { + ALOGE("b/23680780"); + return BAD_VALUE; + } size_t length = U16_AT(ptr); ptr += 2; @@ -305,8 +316,10 @@ status_t convertMetaDataToMessage( } else if (meta->findData(kKeyHVCC, &type, &data, &size)) { const uint8_t *ptr = (const uint8_t *)data; - CHECK(size >= 7); - //CHECK_EQ((unsigned)ptr[0], 1u); // configurationVersion == 1 + if (size < 23 || ptr[0] != 1) { // configurationVersion == 1 + ALOGE("b/23680780"); + return BAD_VALUE; + } uint8_t profile __unused = ptr[1] & 31; uint8_t level __unused = ptr[12]; ptr += 22; @@ -325,6 +338,10 @@ status_t convertMetaDataToMessage( buffer->setRange(0, 0); for (i = 0; i < numofArrays; i++) { + if (size < 3) { + ALOGE("b/23680780"); + return BAD_VALUE; + } ptr += 1; size -= 1; @@ -335,7 +352,10 @@ status_t convertMetaDataToMessage( size -= 2; for (j = 0; j < numofNals; j++) { - CHECK(size >= 2); + if (size < 2) { + ALOGE("b/23680780"); + return BAD_VALUE; + } size_t length = U16_AT(ptr); ptr += 2; |