Instead of asserting on malformed ADTS headers or insufficient data,

stop decoding and signal a runtime error.

Change-Id: Ib66a17a2908273f65a92999951439cc6f0752164
related-to-bug: 6519161

1 files changed, 43 insertions, 18 deletions

diff --git a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
index b5a8da8..9f6db4c 100644
--- a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
+++ b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
@@ -21,6 +21,7 @@
 
 #include <media/stagefright/foundation/ADebug.h>
 #include <media/stagefright/foundation/hexdump.h>
+#include <media/stagefright/MediaErrors.h>
 
 #define FILEREAD_MAX_LAYERS 2
 
@@ -336,24 +337,48 @@ void SoftAAC2::onQueueFilled(OMX_U32 portIndex) {
 
             const uint8_t *adtsHeader = inHeader->pBuffer + inHeader->nOffset;
 
-            CHECK_GE(inHeader->nFilledLen, 7);
-
-            bool protectionAbsent = (adtsHeader[1] & 1);
-
-            unsigned aac_frame_length =
-                ((adtsHeader[3] & 3) << 11)
-                | (adtsHeader[4] << 3)
-                | (adtsHeader[5] >> 5);
-
-            CHECK_GE(inHeader->nFilledLen, aac_frame_length);
-
-            adtsHeaderSize = (protectionAbsent ? 7 : 9);
-
-            inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize;
-            inBufferLength[0] = aac_frame_length - adtsHeaderSize;
-
-            inHeader->nOffset += adtsHeaderSize;
-            inHeader->nFilledLen -= adtsHeaderSize;
+            bool signalError = false;
+            if (inHeader->nFilledLen < 7) {
+                ALOGE("Audio data too short to contain even the ADTS header. "
+                      "Got %ld bytes.", inHeader->nFilledLen);
+                hexdump(adtsHeader, inHeader->nFilledLen);
+                signalError = true;
+            } else {
+                bool protectionAbsent = (adtsHeader[1] & 1);
+
+                unsigned aac_frame_length =
+                    ((adtsHeader[3] & 3) << 11)
+                    | (adtsHeader[4] << 3)
+                    | (adtsHeader[5] >> 5);
+
+                if (inHeader->nFilledLen < aac_frame_length) {
+                    ALOGE("Not enough audio data for the complete frame. "
+                          "Got %ld bytes, frame size according to the ADTS "
+                          "header is %u bytes.",
+                          inHeader->nFilledLen, aac_frame_length);
+                    hexdump(adtsHeader, inHeader->nFilledLen);
+                    signalError = true;
+                } else {
+                    adtsHeaderSize = (protectionAbsent ? 7 : 9);
+
+                    inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize;
+                    inBufferLength[0] = aac_frame_length - adtsHeaderSize;
+
+                    inHeader->nOffset += adtsHeaderSize;
+                    inHeader->nFilledLen -= adtsHeaderSize;
+                }
+
+                if (signalError) {
+                    mSignalledError = true;
+
+                    notify(OMX_EventError,
+                           OMX_ErrorStreamCorrupt,
+                           ERROR_MALFORMED,
+                           NULL);
+
+                    return;
+                }
+            }
         } else {
             inBuffer[0] = inHeader->pBuffer + inHeader->nOffset;
             inBufferLength[0] = inHeader->nFilledLen;