commit 3afa6a5f86d32d6367d7ccae23a76a193de3fb68
author TreeHugger Robot <treehugger-gerrit@google.com> Fri Jul 28 02:57:28 2017 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri Jul 28 02:57:28 2017 +0000
tree d4bc86221861d8fe649029fe04299e4cb72acef1
parent 4b5215993a7d78c0b9f1d5be9e55fb41cd8f32bc
parent 212335cbc6e8795c3cfb332e7b119e03cf33f603

Merge "Fix the UAF bug caused by a dead stack variable" into oc-dr1-dev

media/libstagefright/MPEG4Writer.cpp

diff --git a/media/libstagefright/MPEG4Writer.cpp b/media/libstagefright/MPEG4Writer.cpp
index 92399f1..93d4f57 100644
--- a/media/libstagefright/MPEG4Writer.cpp
+++ b/media/libstagefright/MPEG4Writer.cpp
@@ -1860,10 +1860,12 @@
             || !strcasecmp(mime, MEDIA_MIMETYPE_AUDIO_AAC)) {
         if (mMeta->findData(kKeyESDS, &type, &data, &size)) {
             ESDS esds(data, size);
-            if (esds.getCodecSpecificInfo(&data, &size) != OK) {
-                data = NULL;
-                size = 0;
+            if (esds.getCodecSpecificInfo(&data, &size) == OK &&
+                    data != NULL &&
+                    copyCodecSpecificData((uint8_t*)data, size) == OK) {
+                mGotAllCodecSpecificData = true;
             }
+            return;
         }
     }
     if (data != NULL && copyCodecSpecificData((uint8_t *)data, size) == OK) {