diff options
| author | Marco Nelissen <marcone@google.com> | 2015-08-19 15:36:12 -0700 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2015-10-19 02:58:39 +0200 |
| commit | 6067ac044bec6a422c7782973b8627a925fd0d8f (patch) | |
| tree | 2a0aa8c1ecfb759a4aa65cc363311be0b54b7611 | |
| parent | 7cb902635e3fc1cffcd1bd0892cc1dad4f42497e (diff) | |
| download | frameworks_av-6067ac044bec6a422c7782973b8627a925fd0d8f.zip frameworks_av-6067ac044bec6a422c7782973b8627a925fd0d8f.tar.gz frameworks_av-6067ac044bec6a422c7782973b8627a925fd0d8f.tar.bz2 | |
Check RTSP payload length
Bug: 23346388
Change-Id: Ifd918cefc90527c2f52177c3ce0da7a13259ad08
Tested-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
| -rw-r--r-- | media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp index f9a44f0..0ff0650 100644 --- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp +++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp @@ -406,8 +406,9 @@ sp<ABuffer> AMPEG4AudioAssembler::removeLATMFraming(const sp<ABuffer> &buffer) { break; } } - - CHECK_LE(offset + payloadLength, buffer->size()); + + CHECK_LT(offset, buffer->size()); + CHECK_LE(payloadLength, buffer->size() - offset); memcpy(out->data() + out->size(), &ptr[offset], payloadLength); out->setRange(0, out->size() + payloadLength); |