diff options
Diffstat (limited to 'media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp')
| -rw-r--r-- | media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp index a1a6576..4302aee 100644 --- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp +++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp @@ -379,7 +379,10 @@ sp<ABuffer> AMPEG4AudioAssembler::removeLATMFraming(const sp<ABuffer> &buffer) { unsigned muxSlotLengthBytes = 0; unsigned tmp; do { - CHECK_LT(offset, buffer->size()); + if (offset >= buffer->size()) { + ALOGW("Malformed buffer received"); + return out; + } tmp = ptr[offset++]; muxSlotLengthBytes += tmp; } while (tmp == 0xff); @@ -420,6 +423,11 @@ sp<ABuffer> AMPEG4AudioAssembler::removeLATMFraming(const sp<ABuffer> &buffer) { CHECK_LE(offset + (mOtherDataLenBits / 8), buffer->size()); offset += mOtherDataLenBits / 8; } + + if (i < mNumSubFrames && offset >= buffer->size()) { + ALOGW("Skip subframes after %d, total %d", (int)i, (int)mNumSubFrames); + break; + } } if (offset < buffer->size()) { |