commit 789c984ee567aa5f8539dbb149d3c0c7cf235dd4
author Chong Zhang <chz@google.com> Fri Jul 07 18:25:16 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Jul 26 23:13:06 2017 +0000
tree 5d9c8e4f3ff3193a8e8d09c1baf6a74b452e7aca
parent 7c0e2d4dfdc552f78358b10f70e830f5664bc93c

stagefright: check aac_frame_length to prevent infinite loop

bug: 62673179
Change-Id: I5da44822ad2ff59d396d1df42f34cd0a5620e134
(cherry picked from commit 6e2bcf40e4083be3a0fbb13d03293a78301e66ef)

media/libstagefright/mpeg2ts/ESQueue.cpp

diff --git a/media/libstagefright/mpeg2ts/ESQueue.cpp b/media/libstagefright/mpeg2ts/ESQueue.cpp
index 96ca405..7599c13 100644
--- a/media/libstagefright/mpeg2ts/ESQueue.cpp
+++ b/media/libstagefright/mpeg2ts/ESQueue.cpp
@@ -716,6 +716,11 @@
         bits.skipBits(2);
 
         unsigned aac_frame_length = bits.getBits(13);
+        if (aac_frame_length == 0){
+            ALOGE("b/62673179, Invalid AAC frame length!");
+            android_errorWriteLog(0x534e4554, "62673179");
+            return NULL;
+        }
 
         bits.skipBits(11);  // adts_buffer_fullness