commit cf2f0ba84934918bccedbdeadb14803d0ddc5319
author Roger1 Jonsson <roger1.jonsson@sonymobile.com> Wed Oct 26 09:20:00 2016 +0200
committer android-merger <android-merger@vpba3.mtv.corp.google.com> Mon Apr 24 15:26:03 2017 -0700
tree 7b6269ffec5dd9f0bab24442af92079d444b1983
parent 0be0ed5a7c9d288f324675e80b0fca657570a8bf

Avoid crash for stss sync sample number 0

A sample number value of 0 means that the value stored in
the mSyncSamples array, would become negative (-1),
when converted to index value. This causes a crash.

Make sure that stss sample numbers are bigger
than 0 before converting sample number to index value.

Bug: 32423862
bug: 35645051
Test: Playback video that triggers stss sync sample number 0
Change-Id: I35bee7c718e01b086d7e05deda13b38083f509f5
(cherry picked from commit 024e783acdff65cdb8eb9de5ade3359ebb338a3b)

media/libstagefright/SampleTable.cpp

diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index 161ddfc..ee5fdf0 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -567,6 +567,10 @@
     }
 
     for (size_t i = 0; i < numSyncSamples; ++i) {
+        if (mSyncSamples[i] == 0) {
+            ALOGE("b/32423862, unexpected zero value in stss");
+            continue;
+        }
         mSyncSamples[i] = ntohl(mSyncSamples[i]) - 1;
     }