AMPEG4ElementaryAssembler: reject malformed desc
Bug: 124777537
Test: (1) python rtsp_server2.py $server_addr
Test: (2) adb shell am start -a android.intent.action.VIEW
-n com.google.android.apps.photos/.pager.HostPhotoPagerActivity
-t video/'*' -d rtsp://$server_addr/a.mp4
Change-Id: Iacc6882819e0d99ffdab409324301e8f8d8125f7
diff --git a/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp b/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp
index 76d3674..7bd33c1 100644
--- a/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp
+++ b/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp
@@ -203,6 +203,14 @@
unsigned mSerial;
};
+bool AMPEG4ElementaryAssembler::initCheck() {
+ if(mSizeLength == 0 || mIndexLength == 0 || mIndexDeltaLength == 0) {
+ android_errorWriteLog(0x534e4554, "124777537");
+ return false;
+ }
+ return true;
+}
+
ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket(
const sp<ARTPSource> &source) {
List<sp<ABuffer> > *queue = source->queue();
diff --git a/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.h b/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.h
index 693fca5..57b7d71 100644
--- a/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.h
+++ b/media/libstagefright/rtsp/AMPEG4ElementaryAssembler.h
@@ -36,6 +36,7 @@
AMPEG4ElementaryAssembler(
const sp<AMessage> ¬ify, const AString &desc,
const AString ¶ms);
+ virtual bool initCheck();
protected:
virtual ~AMPEG4ElementaryAssembler();
diff --git a/media/libstagefright/rtsp/ARTPAssembler.h b/media/libstagefright/rtsp/ARTPAssembler.h
index 7c147be..4082d4c 100644
--- a/media/libstagefright/rtsp/ARTPAssembler.h
+++ b/media/libstagefright/rtsp/ARTPAssembler.h
@@ -39,6 +39,7 @@
void onPacketReceived(const sp<ARTPSource> &source);
virtual void onByeReceived() = 0;
+ virtual bool initCheck() { return true; }
protected:
virtual AssemblyStatus assembleMore(const sp<ARTPSource> &source) = 0;
diff --git a/media/libstagefright/rtsp/ARTPSource.cpp b/media/libstagefright/rtsp/ARTPSource.cpp
index 4afa6f4..f5f8128 100644
--- a/media/libstagefright/rtsp/ARTPSource.cpp
+++ b/media/libstagefright/rtsp/ARTPSource.cpp
@@ -82,6 +82,10 @@
} else {
TRESPASS();
}
+
+ if (mAssembler != NULL && !mAssembler->initCheck()) {
+ mAssembler.clear();
+ }
}
static uint32_t AbsDiff(uint32_t seq1, uint32_t seq2) {
@@ -89,7 +93,7 @@
}
void ARTPSource::processRTPPacket(const sp<ABuffer> &buffer) {
- if (queuePacket(buffer) && mAssembler != NULL) {
+ if (mAssembler != NULL && queuePacket(buffer)) {
mAssembler->onPacketReceived(this);
}
}
@@ -171,7 +175,9 @@
}
void ARTPSource::byeReceived() {
- mAssembler->onByeReceived();
+ if (mAssembler != NULL) {
+ mAssembler->onByeReceived();
+ }
}
void ARTPSource::addFIR(const sp<ABuffer> &buffer) {