commit 9b132a7bdde8388f124e4db5ff54a88a93f8cdb6
author Jaesung Chung <jaesung@google.com> Tue Jun 09 02:56:30 2015 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Jun 09 02:56:31 2015 +0000
tree 6d648e882a71d5c227c90f65e842204ff88c1370
parent ca097142ba4664858bc29bb538bcfcf5ea03ebe7
parent 8a1fa1ebc2375c9dcaca2b78918c6740fff2ca74

Merge "stagefright: check the validity of the range of adaptation field" into mnc-dev

media/libstagefright/mpeg2ts/ATSParser.cpp

diff --git a/media/libstagefright/mpeg2ts/ATSParser.cpp b/media/libstagefright/mpeg2ts/ATSParser.cpp
index 53423ec..db429f6 100644
--- a/media/libstagefright/mpeg2ts/ATSParser.cpp
+++ b/media/libstagefright/mpeg2ts/ATSParser.cpp
@@ -1397,6 +1397,11 @@
     unsigned adaptation_field_length = br->getBits(8);
 
     if (adaptation_field_length > 0) {
+        if (adaptation_field_length * 8 > br->numBitsLeft()) {
+            ALOGV("Adaptation field should be included in a single TS packet.");
+            return ERROR_MALFORMED;
+        }
+
         unsigned discontinuity_indicator = br->getBits(1);
 
         if (discontinuity_indicator) {