commit ea5aa166f8a0399cf1ab91b0dc864e01728e3888
author Ray Essick <essick@google.com> Tue Feb 26 15:47:01 2019 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Wed Mar 13 18:01:41 2019 +0000
tree 6bef31d1648cc922c397c19c7324c2937f1ad13f
parent bdd6d24fb00005fded1d0bb89a7a1875010b651c

Reserve enough space for RTSP CSD

make parameters to GetSizeWidth() reflect values being used in
corresponding EncodeSize() invocations so we won't overflow the buffer.

Bug: 123701862
Test: y
Change-Id: I78596176e6042c95582494a8ae1b9c3160bf5955
(cherry picked from commit c025be8ce5f1b34bdf293ac367685c969bd430ba)

media/libstagefright/rtsp/APacketSource.cpp

diff --git a/media/libstagefright/rtsp/APacketSource.cpp b/media/libstagefright/rtsp/APacketSource.cpp
index 201a5df..c5605b4 100644
--- a/media/libstagefright/rtsp/APacketSource.cpp
+++ b/media/libstagefright/rtsp/APacketSource.cpp
@@ -376,8 +376,8 @@
     ALOGI("VOL dimensions = %dx%d", *width, *height);
 
     size_t len1 = config->size() + GetSizeWidth(config->size()) + 1;
-    size_t len2 = len1 + GetSizeWidth(len1) + 1 + 13;
-    size_t len3 = len2 + GetSizeWidth(len2) + 1 + 3;
+    size_t len2 = len1 + GetSizeWidth(len1 + 13) + 1 + 13;
+    size_t len3 = len2 + GetSizeWidth(len2 + 3) + 1 + 3;
 
     sp<ABuffer> csd = new ABuffer(len3);
     uint8_t *dst = csd->data();