diff options
author | Andreas Huber <andih@google.com> | 2010-02-16 10:46:02 -0800 |
---|---|---|
committer | Andreas Huber <andih@google.com> | 2010-02-16 10:46:02 -0800 |
commit | bc8342721d9e32cac624587e8e5c64372ceaff18 (patch) | |
tree | 325016f36b00beae5a3640ddff7c58c1ac9ca297 /media | |
parent | 241379081e046803b7f4cf4f07091b9de49abf31 (diff) | |
download | frameworks_base-bc8342721d9e32cac624587e8e5c64372ceaff18.zip frameworks_base-bc8342721d9e32cac624587e8e5c64372ceaff18.tar.gz frameworks_base-bc8342721d9e32cac624587e8e5c64372ceaff18.tar.bz2 |
The AMRSource failed to properly release a media buffer in case of error.
related-to-bug: 2441307
Diffstat (limited to 'media')
-rw-r--r-- | media/libstagefright/AMRExtractor.cpp | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/media/libstagefright/AMRExtractor.cpp b/media/libstagefright/AMRExtractor.cpp index 3193d5e..2a16d26 100644 --- a/media/libstagefright/AMRExtractor.cpp +++ b/media/libstagefright/AMRExtractor.cpp @@ -225,27 +225,32 @@ status_t AMRSource::read( return ERROR_IO; } - MediaBuffer *buffer; - status_t err = mGroup->acquire_buffer(&buffer); - if (err != OK) { - return err; - } - if (header & 0x83) { // Padding bits must be 0. + LOGE("padding bits must be 0, header is 0x%02x", header); + return ERROR_MALFORMED; } unsigned FT = (header >> 3) & 0x0f; if (FT > 8 || (!mIsWide && FT > 7)) { + + LOGE("illegal AMR frame type %d", FT); + return ERROR_MALFORMED; } size_t frameSize = getFrameSize(mIsWide, FT); CHECK_EQ(frameSize, mFrameSize); + MediaBuffer *buffer; + status_t err = mGroup->acquire_buffer(&buffer); + if (err != OK) { + return err; + } + n = mDataSource->readAt(mOffset, buffer->data(), frameSize); if (n != (ssize_t)frameSize) { |