commit 8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74
author Jaesung Chung <jaesung@google.com> Fri May 15 14:19:14 2015 +0900
committer Jaesung Chung <jaesung@google.com> Fri May 15 14:32:38 2015 +0900
tree da9a8b731653a7e72b72b9a76d7e88f710c56a0d
parent 6267b539d0d1ee7118aafd976d75cb8db397bc24

stagefright: check the validity of the range of adaptation field

Bug: 20439174
Change-Id: I76a9a3cd1669164cee921191d27d4c669eeb9ae0

media/libstagefright/mpeg2ts/ATSParser.cpp

diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp
index e8b2219..fc9b270 100644
--- a/media/libstagefright/mpeg2ts/ATSParser.cpp
+++ b/media/libstagefright/mpeg2ts/ATSParser.cpp
@@ -1355,6 +1355,11 @@
     unsigned adaptation_field_length = br->getBits(8);
 
     if (adaptation_field_length > 0) {
+        if (adaptation_field_length * 8 > br->numBitsLeft()) {
+            ALOGV("Adaptation field should be included in a single TS packet.");
+            return ERROR_MALFORMED;
+        }
+
         unsigned discontinuity_indicator = br->getBits(1);
 
         if (discontinuity_indicator) {