diff options
Diffstat (limited to 'media')
| -rw-r--r-- | media/libeffects/visualizer/EffectVisualizer.cpp | 11 | ||||
| -rwxr-xr-x | media/libstagefright/MPEG4Extractor.cpp | 23 |
2 files changed, 26 insertions, 8 deletions
diff --git a/media/libeffects/visualizer/EffectVisualizer.cpp b/media/libeffects/visualizer/EffectVisualizer.cpp index 91f9fc7..21fddb1 100644 --- a/media/libeffects/visualizer/EffectVisualizer.cpp +++ b/media/libeffects/visualizer/EffectVisualizer.cpp @@ -602,9 +602,14 @@ int Visualizer_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, case VISUALIZER_CMD_MEASURE: { if (pReplyData == NULL || replySize == NULL || *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) { - ALOGV("VISUALIZER_CMD_MEASURE() error *replySize %" PRIu32 - " < (sizeof(int32_t) * MEASUREMENT_COUNT) %" PRIu32, *replySize, - sizeof(int32_t) * MEASUREMENT_COUNT); + if (replySize == NULL) { + ALOGV("VISUALIZER_CMD_MEASURE() error replySize NULL"); + } else { + ALOGV("VISUALIZER_CMD_MEASURE() error *replySize %" PRIu32 + " < (sizeof(int32_t) * MEASUREMENT_COUNT) %" PRIu32, + *replySize, + uint32_t(sizeof(int32_t)) * MEASUREMENT_COUNT); + } android_errorWriteLog(0x534e4554, "30229821"); return -EINVAL; } diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 80ef7b7..92a1fed 100755 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -481,7 +481,8 @@ sp<MetaData> MPEG4Extractor::getTrackMetaData( } else { uint32_t sampleIndex; uint32_t sampleTime; - if (track->sampleTable->findThumbnailSample(&sampleIndex) == OK + if (track->timescale != 0 && + track->sampleTable->findThumbnailSample(&sampleIndex) == OK && track->sampleTable->getMetaDataForSample( sampleIndex, NULL /* offset */, NULL /* size */, &sampleTime) == OK) { @@ -895,6 +896,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { case FOURCC('s', 'c', 'h', 'i'): case FOURCC('e', 'd', 't', 's'): { + if (chunk_type == FOURCC('m', 'o', 'o', 'v') && depth != 0) { + ALOGE("moov: depth %d", depth); + return ERROR_MALFORMED; + } if (chunk_type == FOURCC('m', 'o', 'o', 'f') && !mMoofFound) { // store the offset of the first segment mMoofFound = true; @@ -923,6 +928,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { bool isTrack = false; if (chunk_type == FOURCC('t', 'r', 'a', 'k')) { + if (depth != 1) { + ALOGE("trak: depth %d", depth); + return ERROR_MALFORMED; + } isTrack = true; Track *track = new Track; @@ -946,6 +955,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { while (*offset < stop_offset) { status_t err = parseChunk(offset, depth + 1); if (err != OK) { + if (isTrack) { + mLastTrack->skipTrack = true; + break; + } return err; } } @@ -1291,10 +1304,6 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { case FOURCC('s', 't', 's', 'd'): { - if (chunk_data_size < 8) { - return ERROR_MALFORMED; - } - uint8_t buffer[8]; if (chunk_data_size < (off64_t)sizeof(buffer)) { return ERROR_MALFORMED; @@ -1892,6 +1901,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) { { *offset += chunk_size; + if (depth != 1) { + ALOGE("mvhd: depth %d", depth); + return ERROR_MALFORMED; + } if (chunk_data_size < 32) { return ERROR_MALFORMED; } |