rtsp: Limit subframe processing to available buffer range
With some RTSP servers, the mpeg4 audio subframe count is inconsistent
with the available data. When attempting to process subframes that would
exceed that available buffer boundaries, this causes a memory access
violation. Add buffer size checks to avoid this failure
CRs-Fixed: 2241161
Bug: 121339589
Change-Id: I030c6f02c478e216c20d9b24fbd6b3a9c1530889
diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
index 82a0631..4302aee 100644
--- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
+++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
@@ -423,6 +423,11 @@
CHECK_LE(offset + (mOtherDataLenBits / 8), buffer->size());
offset += mOtherDataLenBits / 8;
}
+
+ if (i < mNumSubFrames && offset >= buffer->size()) {
+ ALOGW("Skip subframes after %d, total %d", (int)i, (int)mNumSubFrames);
+ break;
+ }
}
if (offset < buffer->size()) {