summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTreeHugger Robot <treehugger-gerrit@google.com>2020-03-20 05:21:37 +0000
committerAndroid (Google) Code Review <android-gerrit@google.com>2020-03-20 05:21:37 +0000
commit01102840bc362208e1ec2e8d50e10f460af158f1 (patch)
tree94d912d2c8a847328d2feb6b0d3715bffb79ca64
parentda52cc201ecf857b2f2ff1fb5596cc730d7bf47c (diff)
parent0f9b8b3328ebd4986b2b7907d256ef973fcf7d34 (diff)
downloadframeworks_av-01102840bc362208e1ec2e8d50e10f460af158f1.tar.gz
frameworks_av-01102840bc362208e1ec2e8d50e10f460af158f1.tar.bz2
frameworks_av-01102840bc362208e1ec2e8d50e10f460af158f1.zip
Merge "Really fix excessive 'trun' box parsing" into qt-qpr1-dev
-rwxr-xr-xmedia/extractors/mp4/MPEG4Extractor.cpp17
1 files changed, 9 insertions, 8 deletions
diff --git a/media/extractors/mp4/MPEG4Extractor.cpp b/media/extractors/mp4/MPEG4Extractor.cpp
index 9d5890c42c..14fe0dc444 100755
--- a/media/extractors/mp4/MPEG4Extractor.cpp
+++ b/media/extractors/mp4/MPEG4Extractor.cpp
@@ -5440,16 +5440,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) {
// apply some sanity (vs strict legality) checks
//
- // clamp the count of entries in the trun box, to avoid spending forever parsing
- // this box. Clamping (vs error) lets us play *something*.
- // 1 million is about 400 msecs on a Pixel3, should be no more than a couple seconds
- // on the slowest devices.
- static constexpr uint32_t kMaxTrunSampleCount = 1000000;
+ static constexpr uint32_t kMaxTrunSampleCount = 10000;
if (sampleCount > kMaxTrunSampleCount) {
- ALOGW("b/123389881 clamp sampleCount(%u) @ kMaxTrunSampleCount(%u)",
+ ALOGW("b/123389881 sampleCount(%u) > kMaxTrunSampleCount(%u)",
sampleCount, kMaxTrunSampleCount);
android_errorWriteLog(0x534e4554, "124389881 count");
-
+ return -EINVAL;
}
}
@@ -5493,7 +5489,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) {
tmp.duration = sampleDuration;
tmp.compositionOffset = sampleCtsOffset;
memset(tmp.iv, 0, sizeof(tmp.iv));
- mCurrentSamples.add(tmp);
+ if (mCurrentSamples.add(tmp) < 0) {
+ ALOGW("b/123389881 failed saving sample(n=%zu)", mCurrentSamples.size());
+ android_errorWriteLog(0x534e4554, "124389881 allocation");
+ mCurrentSamples.clear();
+ return NO_MEMORY;
+ }
dataOffset += sampleSize;
}