From 45737cb776625f17384540523674761e6313e6d4 Mon Sep 17 00:00:00 2001
From: Zach Jang <zachjang@google.com>
Date: Thu, 21 Apr 2016 16:10:50 -0700
Subject: Resolve merge conflict when cp'ing ag/931301 to mnc-mr1-release

Change-Id: I079d1db2d30d126f8aed348bd62451acf741037d
---
 media/libstagefright/include/SampleTable.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'media/libstagefright/include/SampleTable.h')

diff --git a/media/libstagefright/include/SampleTable.h b/media/libstagefright/include/SampleTable.h
index 460492b..3764adb 100644
--- a/media/libstagefright/include/SampleTable.h
+++ b/media/libstagefright/include/SampleTable.h
@@ -24,6 +24,7 @@
 #include <media/stagefright/MediaErrors.h>
 #include <utils/RefBase.h>
 #include <utils/threads.h>
+#include <utils/Vector.h>
 
 namespace android {
 
@@ -111,7 +112,7 @@ private:
     uint32_t mNumSampleSizes;
 
     uint32_t mTimeToSampleCount;
-    uint32_t *mTimeToSample;
+    Vector<uint32_t> mTimeToSample;
 
     struct SampleTimeEntry {
         uint32_t mSampleIndex;
-- 
cgit v1.1


From b57b3967b1a42dd505dbe4fcf1e1d810e3ae3777 Mon Sep 17 00:00:00 2001
From: Pawin Vongmasa <pawin@google.com>
Date: Wed, 20 Apr 2016 15:51:48 -0700
Subject: SampleTable.cpp: Fixed a regression caused by a fix for bug 28076789.

Detail: Before the original fix
(Id207f369ab7b27787d83f5d8fc48dc53ed9fcdc9) for 28076789, the
code allowed a time-to-sample table size to be 0. The change
made in that fix disallowed such situation, which in fact should
be allowed. This current patch allows it again while maintaining
the security of the previous fix.

Bug: 28288202
Bug: 28076789
Change-Id: I1c9a60c7f0cfcbd3d908f24998dde15d5136a295
---
 media/libstagefright/include/SampleTable.h | 1 +
 1 file changed, 1 insertion(+)

(limited to 'media/libstagefright/include/SampleTable.h')

diff --git a/media/libstagefright/include/SampleTable.h b/media/libstagefright/include/SampleTable.h
index 3764adb..465f37c 100644
--- a/media/libstagefright/include/SampleTable.h
+++ b/media/libstagefright/include/SampleTable.h
@@ -111,6 +111,7 @@ private:
     uint32_t mDefaultSampleSize;
     uint32_t mNumSampleSizes;
 
+    bool mHasTimeToSample;
     uint32_t mTimeToSampleCount;
     Vector<uint32_t> mTimeToSample;
 
-- 
cgit v1.1


From 030001de8b26291b139a8c1d594f05130dafac1b Mon Sep 17 00:00:00 2001
From: Pawin Vongmasa <pawin@google.com>
Date: Tue, 21 Jun 2016 19:10:21 -0700
Subject: Impose a size bound for dynamically allocated tables in stbl.

Impose a restriction of 200MiB for tables in stsc, stts, ctts and stss
boxes. Also change mTimeToSample from Vector to array.

Bug: 29367429
Change-Id: I953bea9fe0590268cf27376740f582dc88563d42

Merge conflict resolution of ag/1170200 to mnc-mr2-release
---
 media/libstagefright/include/SampleTable.h | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'media/libstagefright/include/SampleTable.h')

diff --git a/media/libstagefright/include/SampleTable.h b/media/libstagefright/include/SampleTable.h
index 465f37c..552eef7 100644
--- a/media/libstagefright/include/SampleTable.h
+++ b/media/libstagefright/include/SampleTable.h
@@ -24,7 +24,6 @@
 #include <media/stagefright/MediaErrors.h>
 #include <utils/RefBase.h>
 #include <utils/threads.h>
-#include <utils/Vector.h>
 
 namespace android {
 
@@ -96,6 +95,9 @@ private:
     static const uint32_t kSampleSizeType32;
     static const uint32_t kSampleSizeTypeCompact;
 
+    // Limit the total size of all internal tables to 200MiB.
+    static const size_t kMaxTotalSize = 200 * (1 << 20);
+
     sp<DataSource> mDataSource;
     Mutex mLock;
 
@@ -113,7 +115,7 @@ private:
 
     bool mHasTimeToSample;
     uint32_t mTimeToSampleCount;
-    Vector<uint32_t> mTimeToSample;
+    uint32_t* mTimeToSample;
 
     struct SampleTimeEntry {
         uint32_t mSampleIndex;
@@ -139,6 +141,9 @@ private:
     };
     SampleToChunkEntry *mSampleToChunkEntries;
 
+    // Approximate size of all tables combined.
+    uint64_t mTotalSize;
+
     friend struct SampleIterator;
 
     // normally we don't round
-- 
cgit v1.1