commit fad42aa98d692c5fd830f7c61b4eb9faf4f7cdca
author Marco Nelissen <marcone@google.com> Fri Jun 10 23:16:02 2016 +0000
committer android-build-merger <android-build-merger@google.com> Fri Jun 10 23:16:02 2016 +0000
tree deeed67d440a2acdb6d9ff3a6a0a3bf33ae2ead8
parent e66381758d6ba02494251e6097e0774a56524be5
parent 7e6001b97de3a6fa8ed4101dfeb01781807e97bb

Merge \\"DO NOT MERGE SoftAAC2: fix crash on all-zero adts buffer\\" into klp-dev am: dc7357d201
am: 7e6001b97d

Change-Id: I405712eeccacfe73708b571dd7242ee9eeb96715

media/libstagefright/codecs/aacdec/SoftAAC2.cpp

diff --git a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
index 7acedbc..a9da1cc 100644
--- a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
+++ b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
@@ -458,11 +458,15 @@
                 } else {
                     adtsHeaderSize = (protectionAbsent ? 7 : 9);
 
-                    inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize;
-                    inBufferLength[0] = aac_frame_length - adtsHeaderSize;
+                    if (aac_frame_length < adtsHeaderSize) {
+                        signalError = true;
+                    } else {
+                        inBuffer[0] = (UCHAR *)adtsHeader + adtsHeaderSize;
+                        inBufferLength[0] = aac_frame_length - adtsHeaderSize;
 
-                    inHeader->nOffset += adtsHeaderSize;
-                    inHeader->nFilledLen -= adtsHeaderSize;
+                        inHeader->nOffset += adtsHeaderSize;
+                        inHeader->nFilledLen -= adtsHeaderSize;
+                    }
                 }
             }