commit 4d46f6f18f5160b8992ec1e66ef1844212fc7d48
author Marco Nelissen <marcone@google.com> Wed Aug 19 15:36:12 2015 -0700
committer Marco Nelissen <marcone@google.com> Wed Aug 19 15:38:15 2015 -0700
tree e14bc1113d9b6ed64a615a67332fb937ab1403cb
parent f97b6beeb2e2f0977d1c7fa8d2aaafe4e2f4d68a

Check RTSP payload length

Bug: 23346388
Change-Id: Ifd918cefc90527c2f52177c3ce0da7a13259ad08

media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp

diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
index aa8ffc6..851805f 100644
--- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
+++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
@@ -404,8 +404,9 @@
                 break;
             }
         }
-
-        CHECK_LE(offset + payloadLength, buffer->size());
+        
+        CHECK_LT(offset, buffer->size());
+        CHECK_LE(payloadLength, buffer->size() - offset);
 
         memcpy(out->data() + out->size(), &ptr[offset], payloadLength);
         out->setRange(0, out->size() + payloadLength);