2 files changed, 46 insertions, 20 deletions

diff --git a/media/libstagefright/codecs/aacdec/SoftAAC.cpp b/media/libstagefright/codecs/aacdec/SoftAAC.cpp
index 65aa2ad..7c82484 100644
--- a/media/libstagefright/codecs/aacdec/SoftAAC.cpp
+++ b/media/libstagefright/codecs/aacdec/SoftAAC.cpp
@@ -24,6 +24,7 @@
 
 #include <media/stagefright/foundation/ADebug.h>
 #include <media/stagefright/foundation/hexdump.h>
+#include <media/stagefright/MediaErrors.h>
 
 namespace android {
 
@@ -322,24 +323,49 @@ void SoftAAC::onQueueFilled(OMX_U32 portIndex) {
 
             const uint8_t *adtsHeader = inHeader->pBuffer + inHeader->nOffset;
 
-            CHECK_GE(inHeader->nFilledLen, 7);
+            bool signalError = false;
+            if (inHeader->nFilledLen < 7) {
+                ALOGE("Audio data too short to contain even the ADTS header. "
+                      "Got %ld bytes.", inHeader->nFilledLen);
+                hexdump(adtsHeader, inHeader->nFilledLen);
+                signalError = true;
+            } else {
+                bool protectionAbsent = (adtsHeader[1] & 1);
+
+                unsigned aac_frame_length =
+                    ((adtsHeader[3] & 3) << 11)
+                    | (adtsHeader[4] << 3)
+                    | (adtsHeader[5] >> 5);
+
+                if (inHeader->nFilledLen < aac_frame_length) {
+                    ALOGE("Not enough audio data for the complete frame. "
+                          "Got %ld bytes, frame size according to the ADTS "
+                          "header is %u bytes.",
+                          inHeader->nFilledLen, aac_frame_length);
+                    hexdump(adtsHeader, inHeader->nFilledLen);
+                    signalError = true;
+                } else {
+                    adtsHeaderSize = (protectionAbsent ? 7 : 9);
 
-            bool protectionAbsent = (adtsHeader[1] & 1);
+                    mConfig->pInputBuffer =
+                        (UChar *)adtsHeader + adtsHeaderSize;
 
-            unsigned aac_frame_length =
-                ((adtsHeader[3] & 3) << 11)
-                | (adtsHeader[4] << 3)
-                | (adtsHeader[5] >> 5);
+                    mConfig->inputBufferCurrentLength =
+                        aac_frame_length - adtsHeaderSize;
 
-            CHECK_GE(inHeader->nFilledLen, aac_frame_length);
+                    inHeader->nOffset += adtsHeaderSize;
+                    inHeader->nFilledLen -= adtsHeaderSize;
+                }
+            }
 
-            adtsHeaderSize = (protectionAbsent ? 7 : 9);
+            if (signalError) {
+                mSignalledError = true;
 
-            mConfig->pInputBuffer = (UChar *)adtsHeader + adtsHeaderSize;
-            mConfig->inputBufferCurrentLength = aac_frame_length - adtsHeaderSize;
+                notify(OMX_EventError, OMX_ErrorStreamCorrupt,
+                       ERROR_MALFORMED, NULL);
 
-            inHeader->nOffset += adtsHeaderSize;
-            inHeader->nFilledLen -= adtsHeaderSize;
+                return;
+            }
         } else {
             mConfig->pInputBuffer = inHeader->pBuffer + inHeader->nOffset;
             mConfig->inputBufferCurrentLength = inHeader->nFilledLen;
diff --git a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
index 9f6db4c..76c3854 100644
--- a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
+++ b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
@@ -367,17 +367,17 @@ void SoftAAC2::onQueueFilled(OMX_U32 portIndex) {
                     inHeader->nOffset += adtsHeaderSize;
                     inHeader->nFilledLen -= adtsHeaderSize;
                 }
+            }
 
-                if (signalError) {
-                    mSignalledError = true;
+            if (signalError) {
+                mSignalledError = true;
 
-                    notify(OMX_EventError,
-                           OMX_ErrorStreamCorrupt,
-                           ERROR_MALFORMED,
-                           NULL);
+                notify(OMX_EventError,
+                       OMX_ErrorStreamCorrupt,
+                       ERROR_MALFORMED,
+                       NULL);
 
-                    return;
-                }
+                return;
             }
         } else {
             inBuffer[0] = inHeader->pBuffer + inHeader->nOffset;