commit a27fe8d7cc1413041e38f8c74f1f6510bdc44627
author Abhishek Arya <aarya@google.com> Thu Aug 20 17:58:52 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Aug 20 17:58:52 2015 +0000
tree c367f1dfe645a46f280bab71b8b950d78a43970d
parent 776bfd806a1619ac0944d4ea36330c4cde4d665d
parent 2fd79fa39a0ec347a80ceb5b056ed5053002f59e

am 2fd79fa3: am cb2acbfe: am 635d38a8: Merge "Check RTSP payload length" into klp-dev

* commit '2fd79fa39a0ec347a80ceb5b056ed5053002f59e':
  Check RTSP payload length

media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp

diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
index aa8ffc6..851805f 100644
--- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
+++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
@@ -404,8 +404,9 @@
                 break;
             }
         }
-
-        CHECK_LE(offset + payloadLength, buffer->size());
+        
+        CHECK_LT(offset, buffer->size());
+        CHECK_LE(payloadLength, buffer->size() - offset);
 
         memcpy(out->data() + out->size(), &ptr[offset], payloadLength);
         out->setRange(0, out->size() + payloadLength);