commit 79cf158c51eb40abd734ae0503909e92948ebb00
author Marco Nelissen <marcone@google.com> Mon Feb 13 21:51:31 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Feb 13 21:51:31 2017 +0000
tree 298578f4966f66e25d4893a6a7c600460669caec
parent a6b1816e163ef1cf9deb2a605a7800c8e0b8edf9
parent f8a2e81bc460a33e4198cc5146ac76c9b970c0a4

Merge "stagefright: parseApp check data boundary conditions" into klp-dev am: 65433ff04d am: 86bd734f58 am: 7902138f2e am: a23c9a47ab
am: f8a2e81bc4

Change-Id: I64518f5a3860f66d3e232589f8c9ef643e572053

media/libstagefright/wifi-display/rtp/RTPSender.cpp

diff --git a/media/libstagefright/wifi-display/rtp/RTPSender.cpp b/media/libstagefright/wifi-display/rtp/RTPSender.cpp
index e88a3bd..45321c6 100644
--- a/media/libstagefright/wifi-display/rtp/RTPSender.cpp
+++ b/media/libstagefright/wifi-display/rtp/RTPSender.cpp
@@ -765,9 +765,15 @@
 }
 
 status_t RTPSender::parseAPP(const uint8_t *data, size_t size) {
-    if (!memcmp("late", &data[8], 4)) {
-        int64_t avgLatencyUs = (int64_t)U64_AT(&data[12]);
-        int64_t maxLatencyUs = (int64_t)U64_AT(&data[20]);
+    static const size_t late_offset = 8;
+    static const char late_string[] = "late";
+    static const size_t avgLatencyUs_offset = late_offset + sizeof(late_string) - 1;
+    static const size_t maxLatencyUs_offset = avgLatencyUs_offset + sizeof(int64_t);
+
+    if ((size >= (maxLatencyUs_offset + sizeof(int64_t)))
+            && !memcmp(late_string, &data[late_offset], sizeof(late_string) - 1)) {
+        int64_t avgLatencyUs = (int64_t)U64_AT(&data[avgLatencyUs_offset]);
+        int64_t maxLatencyUs = (int64_t)U64_AT(&data[maxLatencyUs_offset]);
 
         sp<AMessage> notify = mNotify->dup();
         notify->setInt32("what", kWhatInformSender);