summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoger1 Jonsson <roger1.jonsson@sonymobile.com>2016-10-26 09:20:00 +0200
committerAndreas Blaesius <skate4life@gmx.de>2017-09-17 22:11:55 +0200
commit66461a19dae20ad3df643166a39100ef58202bc3 (patch)
treeef91f543f748b555365d0fc39dbd05ac325fdd50
parent9fd7435ee2831939df35cb8871d21915c7c84f28 (diff)
downloadframeworks_av-66461a19dae20ad3df643166a39100ef58202bc3.tar.gz
frameworks_av-66461a19dae20ad3df643166a39100ef58202bc3.tar.bz2
frameworks_av-66461a19dae20ad3df643166a39100ef58202bc3.zip
Avoid crash for stss sync sample number 0
A sample number value of 0 means that the value stored in the mSyncSamples array, would become negative (-1), when converted to index value. This causes a crash. Make sure that stss sample numbers are bigger than 0 before converting sample number to index value. Bug: 32423862 bug: 35645051 Test: Playback video that triggers stss sync sample number 0 Change-Id: I35bee7c718e01b086d7e05deda13b38083f509f5 (cherry picked from commit 024e783acdff65cdb8eb9de5ade3359ebb338a3b)
-rw-r--r--media/libstagefright/SampleTable.cpp4
1 files changed, 4 insertions, 0 deletions
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index 2d7e613e54..c07bedb5ab 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -562,6 +562,10 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size)
}
for (size_t i = 0; i < numSyncSamples; ++i) {
+ if (mSyncSamples[i] == 0) {
+ ALOGE("b/32423862, unexpected zero value in stss");
+ continue;
+ }
mSyncSamples[i] = ntohl(mSyncSamples[i]) - 1;
}