commit bad3b1e9177780e75ca0fc49a293d841a4e638d2
author Ray Essick <essick@google.com> Tue Feb 06 11:25:31 2018 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Mar 16 21:38:08 2018 +0000
tree d8c60f023e289bac464718c5ad2603cba4540994
parent 4e333fe21279ad60ba0d724e1cb2792208e2b6c4

Check NAL size before looking inside

Add a check to ensure we have a non-zero size for a NAL while
parsing before we crack said NAL open to see what type it is.

Bug: 72117051
Test: compilation
Change-Id: Iaa3ebb2daae5d9225060a11e9adbb6757a168656
Merged-In: I607c67a320b33b991476db30d78223cf4386c0e8
(cherry picked from commit e0c020969d88891b0b71bb938778e9ca762e8035)

media/libstagefright/avc_utils.cpp

diff --git a/media/libstagefright/avc_utils.cpp b/media/libstagefright/avc_utils.cpp
index 5ca2e87..308ef32 100644
--- a/media/libstagefright/avc_utils.cpp
+++ b/media/libstagefright/avc_utils.cpp
@@ -330,7 +330,7 @@
     const uint8_t *nalStart;
     size_t nalSize;
     while (getNextNALUnit(&data, &size, &nalStart, &nalSize, true) == OK) {
-        if ((nalStart[0] & 0x1f) == nalType) {
+        if (nalSize > 0 && (nalStart[0] & 0x1f) == nalType) {
             sp<ABuffer> buffer = new ABuffer(nalSize);
             memcpy(buffer->data(), nalStart, nalSize);
             return buffer;