tree 6f9033839f0b40c3425b210755993589ea0770f6
parent 6ead2c3454f38dac2724a877aa2b57d94877611a
author Rob McConnell <robertwm@broadcom.com> 1548188577 -0800
committer Chong Zhang <chz@google.com> 1548192902 -0800

cas: fix crash with partially scrambled audio content

This patch addresses a situation when MPEG-2 TS level
scrambled audio/video content has some of the audio
content scrambled.  This can cause the MPEG-2 TS
extractor to crash due to it trying to perform an
"out-of-bound" index operation in to the sync points
keyed vector.

The sequence of events to cause this crash are as
follows:

1) The MPEG-2 TS extractor is first initialised and
   begins to search through the content until it finds
   both audio and video scrambled ES.  In the test
   stream, the video ES is found before the audio so
   the "mSourceImpls" Vector contains video as the
   first entry and then audio.

2) The client application makes a call to set mediacas.
   This makes another call to the "init()" method which
   in turn causes the extractor to continue to parses
   the scrambled A/V content.  With the particular test
   stream the audio has predominantly unscrambled PES
   packets and the audio format is readily detected as
   "unscrambled" along with a sync event.  This causes
   the "mSyncPoints" keyed vector to have its first
   entry set for the audio track.

3) When the call to "addSyncPoint_l()" is made this
   method iterates over the "mSourceImpls" vector until
   it finds a match with the event.  In this case it
   finds the audio sync event at the second index
   position.

4) The code makes the assumption that the indexing in
   to "mSourceImpls" and "mSyncPoints" are both tied
   to the same source (i.e. the same track).  This is
   not the case as "mSourceImpls[1]" contains the
   audio source but "mSyncPoints[0]" contains the
   audio sync event.

5) When "addSyncPoint_l()" tries to index in to
   "mSyncPoints[1]", we receive a crash due to an
   "out-of-bound" index operation.

The patch ensures that the "mSourceImpls" and "mSyncPoints"
indexing are identical for the different sources (tracks).
This prevents an "out-of-bound" index access to occur.

bug: 123013446
test:
atest android.media.cts.MediaDrmClearkeyTest#testClearKeyPlaybackMpeg2ts
atest android.media.cts.MediaDrmClearkeyTest#testPlaybackMpeg2ts

Change-Id: I75f5b24eb6a958796add737677f28178243095a4
Signed-off-by: Rob McConnell <robert.mcconnell@broadcom.com>