diff options
| -rwxr-xr-x | media/libstagefright/MPEG4Extractor.cpp | 23 |
1 files changed, 18 insertions, 5 deletions
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 80ef7b7..92a1fed 100755 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -481,7 +481,8 @@ sp<MetaData> MPEG4Extractor::getTrackMetaData( } else { uint32_t sampleIndex; uint32_t sampleTime; - if (track->sampleTable->findThumbnailSample(&sampleIndex) == OK + if (track->timescale != 0 && + track->sampleTable->findThumbnailSample(&sampleIndex) == OK && track->sampleTable->getMetaDataForSample( sampleIndex, NULL /* offset */, NULL /* size */, &sampleTime) == OK) { @@ -895,6 +896,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { case FOURCC('s', 'c', 'h', 'i'): case FOURCC('e', 'd', 't', 's'): { + if (chunk_type == FOURCC('m', 'o', 'o', 'v') && depth != 0) { + ALOGE("moov: depth %d", depth); + return ERROR_MALFORMED; + } if (chunk_type == FOURCC('m', 'o', 'o', 'f') && !mMoofFound) { // store the offset of the first segment mMoofFound = true; @@ -923,6 +928,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { bool isTrack = false; if (chunk_type == FOURCC('t', 'r', 'a', 'k')) { + if (depth != 1) { + ALOGE("trak: depth %d", depth); + return ERROR_MALFORMED; + } isTrack = true; Track *track = new Track; @@ -946,6 +955,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { while (*offset < stop_offset) { status_t err = parseChunk(offset, depth + 1); if (err != OK) { + if (isTrack) { + mLastTrack->skipTrack = true; + break; + } return err; } } @@ -1291,10 +1304,6 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { case FOURCC('s', 't', 's', 'd'): { - if (chunk_data_size < 8) { - return ERROR_MALFORMED; - } - uint8_t buffer[8]; if (chunk_data_size < (off64_t)sizeof(buffer)) { return ERROR_MALFORMED; @@ -1892,6 +1901,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { { *offset += chunk_size; + if (depth != 1) { + ALOGE("mvhd: depth %d", depth); + return ERROR_MALFORMED; + } if (chunk_data_size < 32) { return ERROR_MALFORMED; } |