From 811aa12c4308817abc681f0d85cba82fd12b40c4 Mon Sep 17 00:00:00 2001
From: Ray Essick <essick@google.com>
Date: Tue, 26 Feb 2019 15:47:01 -0800
Subject: [PATCH] Reserve enough space for RTSP CSD

make parameters to GetSizeWidth() reflect values being used in
corresponding EncodeSize() invocations so we won't overflow the buffer.

Bug: 123701862
Test: y
Change-Id: I78596176e6042c95582494a8ae1b9c3160bf5955
(cherry picked from commit c025be8ce5f1b34bdf293ac367685c969bd430ba)
---
 media/libstagefright/rtsp/APacketSource.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/media/libstagefright/rtsp/APacketSource.cpp b/media/libstagefright/rtsp/APacketSource.cpp
index 462c384130..39424fa689 100644
--- a/media/libstagefright/rtsp/APacketSource.cpp
+++ b/media/libstagefright/rtsp/APacketSource.cpp
@@ -379,8 +379,8 @@ static sp<ABuffer> MakeMPEG4VideoCodecSpecificData(
     ALOGI("VOL dimensions = %dx%d", *width, *height);
 
     size_t len1 = config->size() + GetSizeWidth(config->size()) + 1;
-    size_t len2 = len1 + GetSizeWidth(len1) + 1 + 13;
-    size_t len3 = len2 + GetSizeWidth(len2) + 1 + 3;
+    size_t len2 = len1 + GetSizeWidth(len1 + 13) + 1 + 13;
+    size_t len3 = len2 + GetSizeWidth(len2 + 3) + 1 + 3;
 
     sp<ABuffer> csd = new ABuffer(len3);
     uint8_t *dst = csd->data();
