commit 333ceb4f66ccf790081026f645474e07d832fbdb
author Lajos Molnar <lajos@google.com> Fri Mar 21 19:09:48 2014 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri Mar 21 19:09:49 2014 +0000
tree b010fd0eb1520d19debd1e90a9a8d71bd0a833a8
parent f622e2c78407b50806a53a06a89b2b6546420f55
parent 65e20ffc984c541a8119420f917493dd7b703f77

Merge "DO NOT MERGE: PlaylistFetcher: fix infinite loop when parsing ADTS." into klp-dev

media/libstagefright/httplive/PlaylistFetcher.cpp

diff --git a/media/libstagefright/httplive/PlaylistFetcher.cpp b/media/libstagefright/httplive/PlaylistFetcher.cpp
index ada856d..668cbd4 100644
--- a/media/libstagefright/httplive/PlaylistFetcher.cpp
+++ b/media/libstagefright/httplive/PlaylistFetcher.cpp
@@ -1321,6 +1321,18 @@
             | (adtsHeader[4] << 3)
             | (adtsHeader[5] >> 5);
 
+        if (aac_frame_length == 0) {
+            const uint8_t *id3Header = adtsHeader;
+            if (!memcmp(id3Header, "ID3", 3)) {
+                ID3 id3(id3Header, buffer->size() - offset, true);
+                if (id3.isValid()) {
+                    offset += id3.rawSize();
+                    continue;
+                };
+            }
+            return ERROR_MALFORMED;
+        }
+
         CHECK_LE(offset + aac_frame_length, buffer->size());
 
         sp<ABuffer> unit = new ABuffer(aac_frame_length);