Bug 1202677 - Reject mp4 streams with short avc chunks. r=gerald
authorRalph Giles <giles@mozilla.com>
Tue, 08 Sep 2015 14:03:44 -0700
changeset 294459 4c6d311c5911c057a9333ce82f2869ebe484b540
parent 294458 37251ea8e90188288abdd05c667249b636d56ea4
child 294460 d9a4c7d198f08432ddc5b41d64879c15f2cb2391
push id5245
push userraliiev@mozilla.com
push dateThu, 29 Oct 2015 11:30:51 +0000
treeherdermozilla-beta@dac831dc1bd0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersgerald
bugs1202677
milestone43.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1202677 - Reject mp4 streams with short avc chunks. r=gerald
media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
--- a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
@@ -1708,16 +1708,21 @@ status_t MPEG4Extractor::parseChunk(off6
             }
 
             *offset += chunk_size;
             break;
         }
 
         case FOURCC('a', 'v', 'c', 'C'):
         {
+            if (chunk_data_size <= 7) {
+              ALOGE("short avcC chunk (%d bytes)", chunk_data_size);
+              return ERROR_MALFORMED;
+            }
+
             sp<ABuffer> buffer = new ABuffer(chunk_data_size);
 
             if (mDataSource->readAt(
                         data_offset, buffer->data(), chunk_data_size) < chunk_data_size) {
                 return ERROR_IO;
             }
 
             if (!mLastTrack) {