summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorMarco Nelissen <marcone@google.com>2016-04-28 13:32:41 -0700
committerThe Android Automerger <android-build@google.com>2016-05-27 11:30:14 -0700
commit4f236c532039a61f0cf681d2e3c6e022911bbb5c (patch)
tree4704455d5a0fe3f503beb1481df4229531ae971a /media
parentb57b3967b1a42dd505dbe4fcf1e1d810e3ae3777 (diff)
downloadframeworks_av-4f236c532039a61f0cf681d2e3c6e022911bbb5c.zip
frameworks_av-4f236c532039a61f0cf681d2e3c6e022911bbb5c.tar.gz
frameworks_av-4f236c532039a61f0cf681d2e3c6e022911bbb5c.tar.bz2
Check section size when verifying CRC
Bug: 28333006 Change-Id: Ief7a2da848face78f0edde21e2f2009316076679
Diffstat (limited to 'media')
-rw-r--r--media/libstagefright/mpeg2ts/ATSParser.cpp7
1 files changed, 7 insertions, 0 deletions
diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp
index e3c3e80..2f2b115 100644
--- a/media/libstagefright/mpeg2ts/ATSParser.cpp
+++ b/media/libstagefright/mpeg2ts/ATSParser.cpp
@@ -1713,6 +1713,13 @@ bool ATSParser::PSISection::isCRCOkay() const {
unsigned sectionLength = U16_AT(data + 1) & 0xfff;
ALOGV("sectionLength %u, skip %u", sectionLength, mSkipBytes);
+
+ if(sectionLength < mSkipBytes) {
+ ALOGE("b/28333006");
+ android_errorWriteLog(0x534e4554, "28333006");
+ return false;
+ }
+
// Skip the preceding field present when payload start indicator is on.
sectionLength -= mSkipBytes;