commit 7e736a4b7aa8363d92ab83f97b37cbe28ca8ba1c
author Vasily Tarasov <vtarasov@google.com> Thu Nov 01 10:51:08 2018 -0700
committer Vasily Tarasov <vtarasov@google.com> Thu Nov 01 13:51:46 2018 -0700
tree 4d7974d21c8a8a68816a6db30f8e87047f8b6ad1
parent 81b64e7591d708eece16bbb2edad6fc88592ea33

Fix CA descriptor parsing

CA descriptor can be more than 4 bytes long, skip correct length.

Bug: 118717575
Test: GTS, MediaCasWidevineKeyTest#testWidevineKeyPlaybackMpeg2ts

Change-Id: I127caf46dfbe7408e8d58343d7e7614415fa5dd0

media/libstagefright/mpeg2ts/ATSParser.cpp

diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp
index fb498d4..3debe34 100644
--- a/media/libstagefright/mpeg2ts/ATSParser.cpp
+++ b/media/libstagefright/mpeg2ts/ATSParser.cpp
@@ -552,8 +552,10 @@
                 hasStreamCA = true;
                 streamCA.mSystemID = br->getBits(16);
                 streamCA.mPID = br->getBits(16) & 0x1fff;
-                ES_info_length -= 4;
-                streamCA.mPrivateData.assign(br->data(), br->data() + descriptor_length - 4);
+                ES_info_length -= descriptor_length;
+                descriptor_length -= 4;
+                streamCA.mPrivateData.assign(br->data(), br->data() + descriptor_length);
+                br->skipBits(descriptor_length * 8);
             } else if (info.mType == STREAMTYPE_PES_PRIVATE_DATA &&
                        descriptor_tag == DESCRIPTOR_DVB_EXTENSION && descriptor_length >= 1) {
                 unsigned descTagExt = br->getBits(8);