diff options
| author | lubiny <lubiny@codeaurora.org> | 2014-10-09 07:25:32 -0400 |
|---|---|---|
| committer | Linux Build Service Account <lnxbuild@localhost> | 2015-10-06 03:24:52 -0600 |
| commit | 367a60171c0fbfa0afbea842912d1c36aa888af4 (patch) | |
| tree | 032a3ed482cb09df50c6b2d80e8e321996676d81 /media/libstagefright/rtsp | |
| parent | 56d4cd10c3adfa448852fc101780e0b519d8bac8 (diff) | |
| download | frameworks_av-367a60171c0fbfa0afbea842912d1c36aa888af4.zip frameworks_av-367a60171c0fbfa0afbea842912d1c36aa888af4.tar.gz frameworks_av-367a60171c0fbfa0afbea842912d1c36aa888af4.tar.bz2 | |
rtsp: Limit subframe processing to available buffer range
With some RTSP servers, the mpeg4 audio subframe count is inconsistent
with the available data. When attempting to process subframes that would
exceed that available buffer boundaries, this causes a memory access
violation. Add buffer size checks to avoid this crash.
Change-Id: I030c6f02c478e216c20d9b24fbd6b3a9c1530889
CRs-Fixed: 737819
Diffstat (limited to 'media/libstagefright/rtsp')
| -rw-r--r-- | media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp index a1a6576..d239e7b 100644 --- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp +++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp @@ -420,6 +420,11 @@ sp<ABuffer> AMPEG4AudioAssembler::removeLATMFraming(const sp<ABuffer> &buffer) { CHECK_LE(offset + (mOtherDataLenBits / 8), buffer->size()); offset += mOtherDataLenBits / 8; } + + if (i < mNumSubFrames && offset >= buffer->size()) { + ALOGW("Skip subframes after %d, total %d", (int)i, (int)mNumSubFrames); + break; + } } if (offset < buffer->size()) { |