commit d55f55d2f8beffcfbdd3f2b66007ea6d4f851d73
author Santiago Seifert <aquilescanta@google.com> Tue Nov 16 14:34:22 2021 +0000
committer Santiago Seifert <aquilescanta@google.com> Tue Nov 16 14:34:22 2021 +0000
tree d63ba6793aa9fa46816b80beb5e4fe4bd1dae495
parent 30a4e6c7f92eafe45924d298896ecf6a94c57628

Prevent out-of-bounds read

Bug: 204077881
Test: See bug for PoC instructions.
Change-Id: Ie8d6792ff391d36d0e199a1d7f649e6081c1e8ac

media/libstagefright/rtsp/AAVCAssembler.cpp

diff --git a/media/libstagefright/rtsp/AAVCAssembler.cpp b/media/libstagefright/rtsp/AAVCAssembler.cpp
index 3f4d662..30cdbc9 100644
--- a/media/libstagefright/rtsp/AAVCAssembler.cpp
+++ b/media/libstagefright/rtsp/AAVCAssembler.cpp
@@ -295,6 +295,10 @@
 }
 
 void AAVCAssembler::checkSpsUpdated(const sp<ABuffer> &buffer) {
+    if (buffer->size() == 0) {
+        android_errorWriteLog(0x534e4554, "204077881");
+        return;
+    }
     const uint8_t *data = buffer->data();
     unsigned nalType = data[0] & 0x1f;
     if (nalType == 0x7) {