stagefright-plugins: Fix crash if nal size is not 3/4

[android-x86/external-stagefright-plugins.git] / extractor / FFmpegExtractor.cpp

diff --git a/extractor/FFmpegExtractor.cpp b/extractor/FFmpegExtractor.cpp
index 3e150bb..1a27f68 100644 (file)
--- a/extractor/FFmpegExtractor.cpp
+++ b/extractor/FFmpegExtractor.cpp
@@ -1436,6 +1436,7 @@ status_t FFmpegSource::read(
     int64_t timeUs = AV_NOPTS_VALUE;
     int key = 0;
     status_t status = OK;
+    int max_negative_time_frame = 100;
 
     int64_t startTimeUs = mStream->start_time == AV_NOPTS_VALUE ? 0 :
         av_rescale_q(mStream->start_time, mStream->time_base, AV_TIME_BASE_Q);
@@ -1508,7 +1509,13 @@ retry:
     //copy data
     if ((mIsAVC || mIsHEVC) && mNal2AnnexB) {
         /* This only works for NAL sizes 3-4 */
-        CHECK(mNALLengthSize == 3 || mNALLengthSize == 4);
+        if ((mNALLengthSize != 3) && (mNALLengthSize != 4)) {
+            ALOGE("cannot use convertNal2AnnexB, nal size: %d", mNALLengthSize);
+            mediaBuffer->release();
+            mediaBuffer = NULL;
+            av_packet_unref(&pkt);
+            return ERROR_MALFORMED;
+        }
 
         uint8_t *dst = (uint8_t *)mediaBuffer->data();
         /* Convert H.264 NAL format to annex b */
@@ -1541,7 +1548,12 @@ retry:
         mediaBuffer->release();
         mediaBuffer = NULL;
         av_packet_unref(&pkt);
-        return ERROR_MALFORMED;
+        if (max_negative_time_frame-- > 0) {
+            goto retry;
+        } else {
+            ALOGE("too many negative timestamp packets, abort decoding");
+            return ERROR_MALFORMED;
+        }
     }
 
     // predict the next PTS to use for exact-frame seek below