From 811aa12c4308817abc681f0d85cba82fd12b40c4 Mon Sep 17 00:00:00 2001 From: Ray Essick Date: Tue, 26 Feb 2019 15:47:01 -0800 Subject: [PATCH] Reserve enough space for RTSP CSD make parameters to GetSizeWidth() reflect values being used in corresponding EncodeSize() invocations so we won't overflow the buffer. Bug: 123701862 Test: y Change-Id: I78596176e6042c95582494a8ae1b9c3160bf5955 (cherry picked from commit c025be8ce5f1b34bdf293ac367685c969bd430ba) --- media/libstagefright/rtsp/APacketSource.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/media/libstagefright/rtsp/APacketSource.cpp b/media/libstagefright/rtsp/APacketSource.cpp index 462c384130..39424fa689 100644 --- a/media/libstagefright/rtsp/APacketSource.cpp +++ b/media/libstagefright/rtsp/APacketSource.cpp @@ -379,8 +379,8 @@ static sp MakeMPEG4VideoCodecSpecificData( ALOGI("VOL dimensions = %dx%d", *width, *height); size_t len1 = config->size() + GetSizeWidth(config->size()) + 1; - size_t len2 = len1 + GetSizeWidth(len1) + 1 + 13; - size_t len3 = len2 + GetSizeWidth(len2) + 1 + 3; + size_t len2 = len1 + GetSizeWidth(len1 + 13) + 1 + 13; + size_t len3 = len2 + GetSizeWidth(len2 + 3) + 1 + 3; sp csd = new ABuffer(len3); uint8_t *dst = csd->data();