commit b099085b71eb8bb6eca7636e0344d63db1c65d7f
author Ray Essick <essick@google.com> Tue Mar 06 15:55:29 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Apr 13 22:09:17 2018 +0000
tree 759455339622f052c08dec252577cd7de32c9065
parent 6cdf9f58e1f23eca321f4acd7be067343b6e8aa2

better mpeg2 TS elementary stream Access Unit parsing

mpeg2 es stream access units have a 3 byte prefix and a 1 byte start
code. Searching for the next access unit started after the prefix
instead of after the start byte.

Bug: 74114680
Test: ran POC before/after
(cherry picked from commit 371066d073c5db289b0f38b9d2bfd3e326c78c66)

Change-Id: I9027b92100ec6a8e70ac8a8b5b5ecf8d6098ffca

media/libstagefright/mpeg2ts/ESQueue.cpp

diff --git a/media/libstagefright/mpeg2ts/ESQueue.cpp b/media/libstagefright/mpeg2ts/ESQueue.cpp
index 1cf9744..11f3ed1 100644
--- a/media/libstagefright/mpeg2ts/ESQueue.cpp
+++ b/media/libstagefright/mpeg2ts/ESQueue.cpp
@@ -1486,7 +1486,9 @@
         const uint8_t *data, size_t size) {
     static const char kStartCode[] = "\x00\x00\x01";
 
-    if (size < 3) {
+    // per ISO/IEC 14496-2 6.2.1, a chunk has a 3-byte prefix + 1-byte start code
+    // we need at least <prefix><start><next prefix> to successfully scan
+    if (size < 3 + 1 + 3) {
         return -EAGAIN;
     }
 
@@ -1494,7 +1496,7 @@
         return -EAGAIN;
     }
 
-    size_t offset = 3;
+    size_t offset = 4;
     while (offset + 2 < size) {
         if (!memcmp(&data[offset], kStartCode, 3)) {
             return offset;
@@ -1545,6 +1547,9 @@
                     state = EXPECT_VISUAL_OBJECT_START;
                 } else {
                     discard = true;
+                    offset += chunkSize;
+                    ALOGW("b/74114680, advance to next chunk");
+                    android_errorWriteLog(0x534e4554, "74114680");
                 }
                 break;
             }