diff options
| author | Marco Nelissen <marcone@google.com> | 2016-04-28 13:32:41 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-05-27 11:30:14 -0700 |
| commit | 4f236c532039a61f0cf681d2e3c6e022911bbb5c (patch) | |
| tree | 4704455d5a0fe3f503beb1481df4229531ae971a /media/libstagefright | |
| parent | b57b3967b1a42dd505dbe4fcf1e1d810e3ae3777 (diff) | |
| download | frameworks_av-4f236c532039a61f0cf681d2e3c6e022911bbb5c.zip frameworks_av-4f236c532039a61f0cf681d2e3c6e022911bbb5c.tar.gz frameworks_av-4f236c532039a61f0cf681d2e3c6e022911bbb5c.tar.bz2 | |
Check section size when verifying CRC
Bug: 28333006
Change-Id: Ief7a2da848face78f0edde21e2f2009316076679
Diffstat (limited to 'media/libstagefright')
| -rw-r--r-- | media/libstagefright/mpeg2ts/ATSParser.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp index e3c3e80..2f2b115 100644 --- a/media/libstagefright/mpeg2ts/ATSParser.cpp +++ b/media/libstagefright/mpeg2ts/ATSParser.cpp @@ -1713,6 +1713,13 @@ bool ATSParser::PSISection::isCRCOkay() const { unsigned sectionLength = U16_AT(data + 1) & 0xfff; ALOGV("sectionLength %u, skip %u", sectionLength, mSkipBytes); + + if(sectionLength < mSkipBytes) { + ALOGE("b/28333006"); + android_errorWriteLog(0x534e4554, "28333006"); + return false; + } + // Skip the preceding field present when payload start indicator is on. sectionLength -= mSkipBytes; |