Bug 1049241 - [MADAI][Multimedia] Cannot play some RTSP link due to e…

…rror in MP4A-LATM assembler. r=sworkman
dothq · Sep 3, 2014 · aed1b15 · aed1b15
1 parent da624ae
commit aed1b15
Showing 1 changed file with 11 additions and 7 deletions.
diff --git a/netwerk/protocol/rtsp/rtsp/AMPEG4AudioAssembler.cpp b/netwerk/protocol/rtsp/rtsp/AMPEG4AudioAssembler.cpp
@@ -381,7 +381,11 @@ sp<ABuffer> AMPEG4AudioAssembler::removeLATMFraming(const sp<ABuffer> &buffer) {
                 unsigned muxSlotLengthBytes = 0;
                 unsigned tmp;
                 do {
-                    CHECK_LT(offset, buffer->size());
+                    if (offset >= buffer->size()) {
+                        LOGI("Malformed packet found in removeLATMFraming");
+                        mAccessUnitDamaged = true;
+                        return out;
+                    }
                     tmp = ptr[offset++];
                     muxSlotLengthBytes += tmp;
                 } while (tmp == 0xff);
@@ -407,7 +411,11 @@ sp<ABuffer> AMPEG4AudioAssembler::removeLATMFraming(const sp<ABuffer> &buffer) {
             }
         }
 
-        CHECK_LE(offset + payloadLength, buffer->size());
+        if ((offset + payloadLength) > buffer->size()) {
+            LOGI("Malformed packet found in removeLATMFraming");
+            mAccessUnitDamaged = true;
+            return out;
+        }
 
         memcpy(out->data() + out->size(), &ptr[offset], payloadLength);
         out->setRange(0, out->size() + payloadLength);
@@ -552,17 +560,13 @@ void AMPEG4AudioAssembler::submitAccessUnit() {
         memcpy((uint8_t *)accessUnit->data() + offset,
                unit->data(), unit->size());
 
+        offset += unit->size();
         ++it;
     }
 
     accessUnit = removeLATMFraming(accessUnit);
     CopyTimes(accessUnit, *mPackets.begin());
 
-#if 0
-    printf(mAccessUnitDamaged ? "X" : ".");
-    fflush(stdout);
-#endif
-
     if (mAccessUnitDamaged) {
         accessUnit->meta()->setInt32("damaged", true);
     }