commit f9e149c452abd34420e22c58231332eff8d840e6
author Chong Zhang <chz@google.com> Mon Jul 10 12:11:41 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Tue Aug 08 22:24:28 2017 +0000
tree 9b907a6d9f63e1dd7fccdcbfe361e8d3d3ad05e3
parent 4e01c7065bfb52698951b70df81cb60b8b8f574a

stagefright: fix crash due to bad timestamp index

bug: 62872863
Change-Id: I7f8ae62173d8b4bef0d6c35166427871408ad9dd
(cherry picked from commit 069c97e06521035e81ead2eeff8960613fed9254)

media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp

diff --git a/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp b/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp
index 6e70ded..9a69226 100644
--- a/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp
+++ b/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp
@@ -89,10 +89,10 @@
 }
 
 
-static size_t getMinTimestampIdx(OMX_S64 *pNTimeStamp, bool *pIsTimeStampValid) {
+static ssize_t getMinTimestampIdx(OMX_S64 *pNTimeStamp, bool *pIsTimeStampValid) {
     OMX_S64 minTimeStamp = LLONG_MAX;
-    int idx = -1;
-    for (size_t i = 0; i < MAX_TIME_STAMPS; i++) {
+    ssize_t idx = -1;
+    for (ssize_t i = 0; i < MAX_TIME_STAMPS; i++) {
         if (pIsTimeStampValid[i]) {
             if (pNTimeStamp[i] < minTimeStamp) {
                 minTimeStamp = pNTimeStamp[i];
@@ -788,10 +788,15 @@
             }
 
             if (s_dec_op.u4_output_present) {
-                size_t timeStampIdx;
+                ssize_t timeStampIdx;
                 outHeader->nFilledLen = (mWidth * mHeight * 3) / 2;
 
                 timeStampIdx = getMinTimestampIdx(mTimeStamps, mTimeStampsValid);
+                if (timeStampIdx < 0) {
+                    ALOGE("b/62872863, Invalid timestamp index!");
+                    android_errorWriteLog(0x534e4554, "62872863");
+                    return;
+                }
                 outHeader->nTimeStamp = mTimeStamps[timeStampIdx];
                 mTimeStampsValid[timeStampIdx] = false;