summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorRoger1 Jonsson <roger1.jonsson@sonyericsson.com>2010-12-21 09:57:41 +0100
committerHenrik Baard <henrik.baard@sonymobile.com>2012-12-03 08:13:09 +0100
commita1ca351f98e2e9c3d03654fb9794a7bf7d8f9617 (patch)
tree81a0393567cea4d6364cad33424e3a382bafd86e /media
parent031c93df74621dc2149876dc377aedee8930547f (diff)
downloadframeworks_av-a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617.zip
frameworks_av-a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617.tar.gz
frameworks_av-a1ca351f98e2e9c3d03654fb9794a7bf7d8f9617.tar.bz2
Fix bad checks that causes crash when streaming H.263 content.
Remove checks that causes crash for rtsp streamed h.263 content with certain values in the RTP payload header: Remove zero check for the five reserved bits in the payload header. According to RFC 4629 these bits MUST be ignored by receivers. Remove zero-check for the VRC (Video Redundancy Coding) bit, skip packet instead. Remove zero-check for the PLEN bits (extra picture header), skip packet instead. Remove zero-check for the PEBIT bits (extra picture header), skip packet instead. Remove corresponding zero check for the four resreved bits in the AMR payload header. According to RFC 4867 these bits MUST be ignored by receivers. Change-Id: I7fc21d69a19d23da24f9267623c338d415ef1387
Diffstat (limited to 'media')
-rw-r--r--media/libstagefright/rtsp/AAMRAssembler.cpp1
-rw-r--r--media/libstagefright/rtsp/AH263Assembler.cpp30
2 files changed, 28 insertions, 3 deletions
diff --git a/media/libstagefright/rtsp/AAMRAssembler.cpp b/media/libstagefright/rtsp/AAMRAssembler.cpp
index fb8abc5..9e8725a 100644
--- a/media/libstagefright/rtsp/AAMRAssembler.cpp
+++ b/media/libstagefright/rtsp/AAMRAssembler.cpp
@@ -145,7 +145,6 @@ ARTPAssembler::AssemblyStatus AAMRAssembler::addPacket(
unsigned payloadHeader = buffer->data()[0];
unsigned CMR = payloadHeader >> 4;
- CHECK_EQ(payloadHeader & 0x0f, 0u); // RR
Vector<uint8_t> tableOfContents;
diff --git a/media/libstagefright/rtsp/AH263Assembler.cpp b/media/libstagefright/rtsp/AH263Assembler.cpp
index d0313cc..75cd911 100644
--- a/media/libstagefright/rtsp/AH263Assembler.cpp
+++ b/media/libstagefright/rtsp/AH263Assembler.cpp
@@ -13,6 +13,9 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
+//#define LOG_NDEBUG 0
+#define LOG_TAG "AH263Assembler"
+#include <utils/Log.h>
#include "AH263Assembler.h"
@@ -100,11 +103,34 @@ ARTPAssembler::AssemblyStatus AH263Assembler::addPacket(
}
unsigned payloadHeader = U16_AT(buffer->data());
- CHECK_EQ(payloadHeader >> 11, 0u); // RR=0
unsigned P = (payloadHeader >> 10) & 1;
unsigned V = (payloadHeader >> 9) & 1;
unsigned PLEN = (payloadHeader >> 3) & 0x3f;
- // unsigned PEBIT = payloadHeader & 7;
+ unsigned PEBIT = payloadHeader & 7;
+
+ // V=0
+ if (V != 0u) {
+ queue->erase(queue->begin());
+ ++mNextExpectedSeqNo;
+ ALOGW("Packet discarded due to VRC (V != 0)");
+ return MALFORMED_PACKET;
+ }
+
+ // PLEN=0
+ if (PLEN != 0u) {
+ queue->erase(queue->begin());
+ ++mNextExpectedSeqNo;
+ ALOGW("Packet discarded (PLEN != 0)");
+ return MALFORMED_PACKET;
+ }
+
+ // PEBIT=0
+ if (PEBIT != 0u) {
+ queue->erase(queue->begin());
+ ++mNextExpectedSeqNo;
+ ALOGW("Packet discarded (PEBIT != 0)");
+ return MALFORMED_PACKET;
+ }
size_t skip = V + PLEN + (P ? 0 : 2);