From: Marco Nelissen <marcone@google.com>
Date: Tue, 18 Jul 2017 21:57:11 +0000 (-0700)
Subject: Skip track if verification fails
X-Git-Tag: android-x86-8.1-r1~31^2^2~3^2^2^2^2^2^2^2~6^2~2^2~2^2~10^2
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=ef8c7830d838d877e6b37b75b47294b064c79397;p=android-x86%2Fframeworks-av.git

Skip track if verification fails

Bug: 62187433
Test: ran poc, CTS
Change-Id: Ib9b0b6de88d046d8149e9ea5073d6c40ffec7b0c
---

diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 300b52e27a..a51aecde2a 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -892,6 +892,12 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
                 ALOGE("moov: depth %d", depth);
                 return ERROR_MALFORMED;
             }
+
+            if (chunk_type == FOURCC('m', 'o', 'o', 'v') && mInitCheck == OK) {
+                ALOGE("duplicate moov");
+                return ERROR_MALFORMED;
+            }
+
             if (chunk_type == FOURCC('m', 'o', 'o', 'f') && !mMoofFound) {
                 // store the offset of the first segment
                 mMoofFound = true;
@@ -965,6 +971,12 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
                 if (!mLastTrack->meta->findInt32(kKeyTrackID, &trackId)) {
                     mLastTrack->skipTrack = true;
                 }
+
+                status_t err = verifyTrack(mLastTrack);
+                if (err != OK) {
+                    mLastTrack->skipTrack = true;
+                }
+
                 if (mLastTrack->skipTrack) {
                     Track *cur = mFirstTrack;
 
@@ -982,12 +994,6 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
 
                     return OK;
                 }
-
-                status_t err = verifyTrack(mLastTrack);
-
-                if (err != OK) {
-                    return err;
-                }
             } else if (chunk_type == FOURCC('m', 'o', 'o', 'v')) {
                 mInitCheck = OK;