commit c95f046e1f2063fe0549b3f30bd2452c192a20fd
author Marco Nelissen <marcone@google.com> Thu Nov 12 18:46:54 2015 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Nov 12 18:46:54 2015 +0000
tree b99ce3454c926068eea012ad82505a51dcb229b9
parent e8b0ace57c2614374decc6f8d1c1daa32fc8a361
parent c22c00c82fa37e2c567c1d4976c133bbd46831a0

Merge "Fix possible media extractor service crash"

media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp

diff --git a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
index a1a6576..82a0631 100644
--- a/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
+++ b/media/libstagefright/rtsp/AMPEG4AudioAssembler.cpp
@@ -379,7 +379,10 @@
                 unsigned muxSlotLengthBytes = 0;
                 unsigned tmp;
                 do {
-                    CHECK_LT(offset, buffer->size());
+                    if (offset >= buffer->size()) {
+                        ALOGW("Malformed buffer received");
+                        return out;
+                    }
                     tmp = ptr[offset++];
                     muxSlotLengthBytes += tmp;
                 } while (tmp == 0xff);