Merge "flexibility for having extra policy files" into rvc-dev
diff --git a/media/extractors/mp4/MPEG4Extractor.cpp b/media/extractors/mp4/MPEG4Extractor.cpp
index b72a8cc..aea28c0 100755
--- a/media/extractors/mp4/MPEG4Extractor.cpp
+++ b/media/extractors/mp4/MPEG4Extractor.cpp
@@ -2896,7 +2896,7 @@
return ERROR_MALFORMED;
}
- parseID3v2MetaData(data_offset + 6);
+ parseID3v2MetaData(data_offset + 6, chunk_data_size - 6);
break;
}
@@ -4167,8 +4167,19 @@
return OK;
}
-void MPEG4Extractor::parseID3v2MetaData(off64_t offset) {
- ID3 id3(mDataSource, true /* ignorev1 */, offset);
+void MPEG4Extractor::parseID3v2MetaData(off64_t offset, uint64_t size) {
+ uint8_t *buffer = new (std::nothrow) uint8_t[size];
+ if (buffer == NULL) {
+ return;
+ }
+ if (mDataSource->readAt(offset, buffer, size) != (ssize_t)size) {
+ delete[] buffer;
+ buffer = NULL;
+ return;
+ }
+
+ ID3 id3(buffer, size, true /* ignorev1 */);
+ delete[] buffer;
if (id3.isValid()) {
struct Map {
diff --git a/media/extractors/mp4/MPEG4Extractor.h b/media/extractors/mp4/MPEG4Extractor.h
index 3af432d..1e49d50 100644
--- a/media/extractors/mp4/MPEG4Extractor.h
+++ b/media/extractors/mp4/MPEG4Extractor.h
@@ -161,7 +161,7 @@
status_t parseITunesMetaData(off64_t offset, size_t size);
status_t parseColorInfo(off64_t offset, size_t size);
status_t parse3GPPMetaData(off64_t offset, size_t size, int depth);
- void parseID3v2MetaData(off64_t offset);
+ void parseID3v2MetaData(off64_t offset, uint64_t size);
status_t parseQTMetaKey(off64_t data_offset, size_t data_size);
status_t parseQTMetaVal(int32_t keyId, off64_t data_offset, size_t data_size);
diff --git a/media/libstagefright/timedtext/TextDescriptions.cpp b/media/libstagefright/timedtext/TextDescriptions.cpp
index 0dc7722..6c94754 100644
--- a/media/libstagefright/timedtext/TextDescriptions.cpp
+++ b/media/libstagefright/timedtext/TextDescriptions.cpp
@@ -445,51 +445,75 @@
| *(tmpData + 10) << 8 | *(tmpData + 11);
parcel->writeInt32(rgba);
+ // tx3g box contains class FontTableBox() which extends ftab box
+ // This information is part of the 3gpp Timed Text Format
+ // Specification#: 26.245 / Section: 5.16(Sample Description Format)
+ // https://www.3gpp.org/ftp/Specs/archive/26_series/26.245/
+
tmpData += 12;
remaining -= 12;
- if (remaining < 2) {
+ if (remaining < 8) {
return OK;
}
- size_t dataPos = parcel->dataPosition();
-
- parcel->writeInt32(KEY_STRUCT_FONT_LIST);
- uint16_t count = U16_AT(tmpData);
- parcel->writeInt32(count);
-
- tmpData += 2;
- remaining -= 2;
-
- for (int i = 0; i < count; i++) {
- if (remaining < 3) {
- // roll back
- parcel->setDataPosition(dataPos);
- return OK;
- }
- // font ID
- parcel->writeInt32(U16_AT(tmpData));
-
- // font name length
- parcel->writeInt32(*(tmpData + 2));
-
- size_t len = *(tmpData + 2);
-
- tmpData += 3;
- remaining -= 3;
-
- if (remaining < len) {
- // roll back
- parcel->setDataPosition(dataPos);
- return OK;
- }
-
- parcel->write(tmpData, len);
- tmpData += len;
- remaining -= len;
+ size_t subChunkSize = U32_AT(tmpData);
+ if(remaining < subChunkSize) {
+ return OK;
}
- // there is a "DisparityBox" after this according to the spec, but we ignore it
+ uint32_t subChunkType = U32_AT(tmpData + 4);
+
+ if (subChunkType == FOURCC('f', 't', 'a', 'b'))
+ {
+ tmpData += 8;
+ size_t subChunkRemaining = subChunkSize - 8;
+
+ if(subChunkRemaining < 2) {
+ return OK;
+ }
+ size_t dataPos = parcel->dataPosition();
+
+ parcel->writeInt32(KEY_STRUCT_FONT_LIST);
+ uint16_t count = U16_AT(tmpData);
+ parcel->writeInt32(count);
+
+ tmpData += 2;
+ subChunkRemaining -= 2;
+
+ for (int i = 0; i < count; i++) {
+ if (subChunkRemaining < 3) {
+ // roll back
+ parcel->setDataPosition(dataPos);
+ return OK;
+ }
+ // font ID
+ parcel->writeInt32(U16_AT(tmpData));
+
+ // font name length
+ size_t len = *(tmpData + 2);
+
+ parcel->writeInt32(len);
+
+ tmpData += 3;
+ subChunkRemaining -=3;
+
+ if (subChunkRemaining < len) {
+ // roll back
+ parcel->setDataPosition(dataPos);
+ return OK;
+ }
+
+ parcel->write(tmpData, len);
+ tmpData += len;
+ subChunkRemaining -= len;
+ }
+ tmpData += subChunkRemaining;
+ remaining -= subChunkSize;
+ } else {
+ tmpData += subChunkSize;
+ remaining -= subChunkSize;
+ }
break;
}
default: