diff options
| author | Jaesung Chung <jaesung@google.com> | 2015-05-15 14:19:14 +0900 |
|---|---|---|
| committer | Jaesung Chung <jaesung@google.com> | 2015-05-15 14:32:38 +0900 |
| commit | 8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74 (patch) | |
| tree | da9a8b731653a7e72b72b9a76d7e88f710c56a0d /media/libstagefright/mpeg2ts | |
| parent | 6267b539d0d1ee7118aafd976d75cb8db397bc24 (diff) | |
| download | frameworks_av-8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74.zip frameworks_av-8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74.tar.gz frameworks_av-8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74.tar.bz2 | |
stagefright: check the validity of the range of adaptation field
Bug: 20439174
Change-Id: I76a9a3cd1669164cee921191d27d4c669eeb9ae0
Diffstat (limited to 'media/libstagefright/mpeg2ts')
| -rw-r--r-- | media/libstagefright/mpeg2ts/ATSParser.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp index e8b2219..fc9b270 100644 --- a/media/libstagefright/mpeg2ts/ATSParser.cpp +++ b/media/libstagefright/mpeg2ts/ATSParser.cpp @@ -1355,6 +1355,11 @@ status_t ATSParser::parseAdaptationField(ABitReader *br, unsigned PID) { unsigned adaptation_field_length = br->getBits(8); if (adaptation_field_length > 0) { + if (adaptation_field_length * 8 > br->numBitsLeft()) { + ALOGV("Adaptation field should be included in a single TS packet."); + return ERROR_MALFORMED; + } + unsigned discontinuity_indicator = br->getBits(1); if (discontinuity_indicator) { |