diff options
author | TreeHugger Robot <treehugger-gerrit@google.com> | 2020-03-20 05:21:37 +0000 |
---|---|---|
committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-03-20 05:21:37 +0000 |
commit | 01102840bc362208e1ec2e8d50e10f460af158f1 (patch) | |
tree | 94d912d2c8a847328d2feb6b0d3715bffb79ca64 | |
parent | da52cc201ecf857b2f2ff1fb5596cc730d7bf47c (diff) | |
parent | 0f9b8b3328ebd4986b2b7907d256ef973fcf7d34 (diff) | |
download | frameworks_av-01102840bc362208e1ec2e8d50e10f460af158f1.tar.gz frameworks_av-01102840bc362208e1ec2e8d50e10f460af158f1.tar.bz2 frameworks_av-01102840bc362208e1ec2e8d50e10f460af158f1.zip |
Merge "Really fix excessive 'trun' box parsing" into qt-qpr1-dev
-rwxr-xr-x | media/extractors/mp4/MPEG4Extractor.cpp | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/media/extractors/mp4/MPEG4Extractor.cpp b/media/extractors/mp4/MPEG4Extractor.cpp index 9d5890c42c..14fe0dc444 100755 --- a/media/extractors/mp4/MPEG4Extractor.cpp +++ b/media/extractors/mp4/MPEG4Extractor.cpp @@ -5440,16 +5440,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { // apply some sanity (vs strict legality) checks // - // clamp the count of entries in the trun box, to avoid spending forever parsing - // this box. Clamping (vs error) lets us play *something*. - // 1 million is about 400 msecs on a Pixel3, should be no more than a couple seconds - // on the slowest devices. - static constexpr uint32_t kMaxTrunSampleCount = 1000000; + static constexpr uint32_t kMaxTrunSampleCount = 10000; if (sampleCount > kMaxTrunSampleCount) { - ALOGW("b/123389881 clamp sampleCount(%u) @ kMaxTrunSampleCount(%u)", + ALOGW("b/123389881 sampleCount(%u) > kMaxTrunSampleCount(%u)", sampleCount, kMaxTrunSampleCount); android_errorWriteLog(0x534e4554, "124389881 count"); - + return -EINVAL; } } @@ -5493,7 +5489,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) { tmp.duration = sampleDuration; tmp.compositionOffset = sampleCtsOffset; memset(tmp.iv, 0, sizeof(tmp.iv)); - mCurrentSamples.add(tmp); + if (mCurrentSamples.add(tmp) < 0) { + ALOGW("b/123389881 failed saving sample(n=%zu)", mCurrentSamples.size()); + android_errorWriteLog(0x534e4554, "124389881 allocation"); + mCurrentSamples.clear(); + return NO_MEMORY; + } dataOffset += sampleSize; } |