diff options
author | Roger1 Jonsson <roger1.jonsson@sonyericsson.com> | 2010-12-21 09:57:41 +0100 |
---|---|---|
committer | Henrik Baard <henrik.baard@sonymobile.com> | 2012-12-03 08:13:09 +0100 |
commit | a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617 (patch) | |
tree | 81a0393567cea4d6364cad33424e3a382bafd86e /media | |
parent | 031c93df74621dc2149876dc377aedee8930547f (diff) | |
download | frameworks_av-a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617.zip frameworks_av-a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617.tar.gz frameworks_av-a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617.tar.bz2 |
Fix bad checks that causes crash when streaming H.263 content.
Remove checks that causes crash for rtsp streamed h.263 content
with certain values in the RTP payload header:
Remove zero check for the five reserved bits in the payload header.
According to RFC 4629 these bits MUST be ignored by receivers.
Remove zero-check for the VRC (Video Redundancy Coding) bit,
skip packet instead.
Remove zero-check for the PLEN bits (extra picture header),
skip packet instead.
Remove zero-check for the PEBIT bits (extra picture header),
skip packet instead.
Remove corresponding zero check for the four resreved bits in the
AMR payload header. According to RFC 4867 these bits MUST be
ignored by receivers.
Change-Id: I7fc21d69a19d23da24f9267623c338d415ef1387
Diffstat (limited to 'media')
-rw-r--r-- | media/libstagefright/rtsp/AAMRAssembler.cpp | 1 | ||||
-rw-r--r-- | media/libstagefright/rtsp/AH263Assembler.cpp | 30 |
2 files changed, 28 insertions, 3 deletions
diff --git a/media/libstagefright/rtsp/AAMRAssembler.cpp b/media/libstagefright/rtsp/AAMRAssembler.cpp index fb8abc5..9e8725a 100644 --- a/media/libstagefright/rtsp/AAMRAssembler.cpp +++ b/media/libstagefright/rtsp/AAMRAssembler.cpp @@ -145,7 +145,6 @@ ARTPAssembler::AssemblyStatus AAMRAssembler::addPacket( unsigned payloadHeader = buffer->data()[0]; unsigned CMR = payloadHeader >> 4; - CHECK_EQ(payloadHeader & 0x0f, 0u); // RR Vector<uint8_t> tableOfContents; diff --git a/media/libstagefright/rtsp/AH263Assembler.cpp b/media/libstagefright/rtsp/AH263Assembler.cpp index d0313cc..75cd911 100644 --- a/media/libstagefright/rtsp/AH263Assembler.cpp +++ b/media/libstagefright/rtsp/AH263Assembler.cpp @@ -13,6 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +//#define LOG_NDEBUG 0 +#define LOG_TAG "AH263Assembler" +#include <utils/Log.h> #include "AH263Assembler.h" @@ -100,11 +103,34 @@ ARTPAssembler::AssemblyStatus AH263Assembler::addPacket( } unsigned payloadHeader = U16_AT(buffer->data()); - CHECK_EQ(payloadHeader >> 11, 0u); // RR=0 unsigned P = (payloadHeader >> 10) & 1; unsigned V = (payloadHeader >> 9) & 1; unsigned PLEN = (payloadHeader >> 3) & 0x3f; - // unsigned PEBIT = payloadHeader & 7; + unsigned PEBIT = payloadHeader & 7; + + // V=0 + if (V != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded due to VRC (V != 0)"); + return MALFORMED_PACKET; + } + + // PLEN=0 + if (PLEN != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded (PLEN != 0)"); + return MALFORMED_PACKET; + } + + // PEBIT=0 + if (PEBIT != 0u) { + queue->erase(queue->begin()); + ++mNextExpectedSeqNo; + ALOGW("Packet discarded (PEBIT != 0)"); + return MALFORMED_PACKET; + } size_t skip = V + PLEN + (P ? 0 : 2); |