| commit | d0e524f58873f81549c7abfade30d8c9d2406a1c | [log] [tgz] |
|---|---|---|
| author | Santiago Seifert <aquilescanta@google.com> | Tue Nov 16 14:34:22 2021 +0000 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Wed Dec 15 00:01:39 2021 +0000 |
| tree | 216d9589fc778f344d1ccb31aa54973c01e743a5 | |
| parent | fc120151250f8627b34e72ea3b01060bd9819c22 [diff] |
Prevent out-of-bounds read Bug: 204077881 Test: See bug for PoC instructions. Change-Id: Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac Merged-In: Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac (cherry picked from commit d55f55d2f8beffcfbdd3f2b66007ea6d4f851d73) (cherry picked from commit cc538ed26803328445d52383f91025b357cda47d) Merged-In:Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac
diff --git a/media/libstagefright/rtsp/AAVCAssembler.cpp b/media/libstagefright/rtsp/AAVCAssembler.cpp index 3f4d662..30cdbc9 100644 --- a/media/libstagefright/rtsp/AAVCAssembler.cpp +++ b/media/libstagefright/rtsp/AAVCAssembler.cpp
@@ -295,6 +295,10 @@ } void AAVCAssembler::checkSpsUpdated(const sp<ABuffer> &buffer) { + if (buffer->size() == 0) { + android_errorWriteLog(0x534e4554, "204077881"); + return; + } const uint8_t *data = buffer->data(); unsigned nalType = data[0] & 0x1f; if (nalType == 0x7) {