From 8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74 Mon Sep 17 00:00:00 2001 From: Jaesung Chung Date: Fri, 15 May 2015 14:19:14 +0900 Subject: stagefright: check the validity of the range of adaptation field Bug: 20439174 Change-Id: I76a9a3cd1669164cee921191d27d4c669eeb9ae0 --- media/libstagefright/mpeg2ts/ATSParser.cpp | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'media/libstagefright/mpeg2ts/ATSParser.cpp') diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp index e8b2219..fc9b270 100644 --- a/media/libstagefright/mpeg2ts/ATSParser.cpp +++ b/media/libstagefright/mpeg2ts/ATSParser.cpp @@ -1355,6 +1355,11 @@ status_t ATSParser::parseAdaptationField(ABitReader *br, unsigned PID) { unsigned adaptation_field_length = br->getBits(8); if (adaptation_field_length > 0) { + if (adaptation_field_length * 8 > br->numBitsLeft()) { + ALOGV("Adaptation field should be included in a single TS packet."); + return ERROR_MALFORMED; + } + unsigned discontinuity_indicator = br->getBits(1); if (discontinuity_indicator) { -- cgit v1.1