Merge "Fix a few issues with determining the closest sample to a given time in the MPEG4 sampletable implementation."
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 9e7f1c7..07a5a82 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -984,7 +984,14 @@
             (const uint8_t *)mBuffer->data() + mBuffer->range_offset();
 
         size_t nal_size = parseNALSize(src);
-        CHECK(mBuffer->range_length() >= mNALLengthSize + nal_size);
+        if (mBuffer->range_length() < mNALLengthSize + nal_size) {
+            LOGE("incomplete NAL unit.");
+
+            mBuffer->release();
+            mBuffer = NULL;
+
+            return ERROR_MALFORMED;
+        }
 
         MediaBuffer *clone = mBuffer->clone();
         clone->set_range(mBuffer->range_offset() + mNALLengthSize, nal_size);
@@ -1023,7 +1030,13 @@
             CHECK(srcOffset + mNALLengthSize <= size);
             size_t nalLength = parseNALSize(&mSrcBuffer[srcOffset]);
             srcOffset += mNALLengthSize;
-            CHECK(srcOffset + nalLength <= size);
+
+            if (srcOffset + nalLength > size) {
+                mBuffer->release();
+                mBuffer = NULL;
+
+                return ERROR_MALFORMED;
+            }
 
             if (nalLength == 0) {
                 continue;
diff --git a/media/libstagefright/OMXCodec.cpp b/media/libstagefright/OMXCodec.cpp
index d8bd25d..c4d3b5d 100644
--- a/media/libstagefright/OMXCodec.cpp
+++ b/media/libstagefright/OMXCodec.cpp
@@ -1786,6 +1786,21 @@
 void OMXCodec::fillOutputBuffers() {
     CHECK_EQ(mState, EXECUTING);
 
+    // This is a workaround for some decoders not properly reporting
+    // end-of-output-stream. If we own all input buffers and also own
+    // all output buffers and we already signalled end-of-input-stream,
+    // the end-of-output-stream is implied.
+    if (mSignalledEOS
+            && countBuffersWeOwn(mPortBuffers[kPortIndexInput])
+                == mPortBuffers[kPortIndexInput].size()
+            && countBuffersWeOwn(mPortBuffers[kPortIndexOutput])
+                == mPortBuffers[kPortIndexOutput].size()) {
+        mNoMoreOutputData = true;
+        mBufferFilled.signal();
+
+        return;
+    }
+
     Vector<BufferInfo> *buffers = &mPortBuffers[kPortIndexOutput];
     for (size_t i = 0; i < buffers->size(); ++i) {
         fillOutputBuffer(&buffers->editItemAt(i));
@@ -1833,6 +1848,8 @@
 
         mNoMoreOutputData = false;
 
+        CODEC_LOGV("calling emptyBuffer with codec specific data");
+
         status_t err = mOMX->emptyBuffer(
                 mNode, info->mBuffer, 0, size,
                 OMX_BUFFERFLAG_ENDOFFRAME | OMX_BUFFERFLAG_CODECCONFIG,