commit 2a88b64f847e1f47881eb723da2abb1c4a797946
author Marco Nelissen <marcone@google.com> Wed Aug 19 15:36:12 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 19:24:40 2015 -0700
tree 59b4a4b3d59ca7c86f5b0e03803de6582e90968a
parent 5b8996867951e6f5ad61eff9f1c1b98aa88caea7

Check RTSP payload length

Bug: 23346388
Change-Id: Ifd918cefc90527c2f52177c3ce0da7a13259ad08

media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp

diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
index aa8ffc6..851805f 100644
--- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
+++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
@@ -404,8 +404,9 @@
                 break;
             }
         }
-
-        CHECK_LE(offset + payloadLength, buffer->size());
+        
+        CHECK_LT(offset, buffer->size());
+        CHECK_LE(payloadLength, buffer->size() - offset);
 
         memcpy(out->data() + out->size(), &ptr[offset], payloadLength);
         out->setRange(0, out->size() + payloadLength);