From cfabb92bd794c930c9984dfa3b6ef95f97e0dc67 Mon Sep 17 00:00:00 2001 From: Marten Richter Date: Sat, 20 Apr 2013 10:26:58 +0200 Subject: [PATCH] Add sanity check for mp audio frame sync --- audioomx.cc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/audioomx.cc b/audioomx.cc index dc8199c..c8e18dd 100644 --- a/audioomx.cc +++ b/audioomx.cc @@ -1581,7 +1581,14 @@ unsigned int AudioOMX::AdvanceMpAudioSync(const UCHAR *data,unsigned int size,un int lsf=0; int mpeg2=0; int layer=4-((data[test+1]&0x06)>>1); + if (layer==0) {test++;continue;} //sanity check + int bitrate_index=(data[test+2]&0xf0)>>4; + if (bitrate_index==0x0f || bitrate_index==0x0) {test++;continue;} //sanity check + + int samplerate_index=(data[test+2]&0x0C)>>2; + if (samplerate_index==0x03) {test++;continue;} //sanity check + int padding=(data[test+2]&2)>>1; if (0x10 & data[test+1]) { lsf=((data[test+1]) &0x8)?0:1; @@ -1590,7 +1597,7 @@ unsigned int AudioOMX::AdvanceMpAudioSync(const UCHAR *data,unsigned int size,un lsf=1; mpeg2=1; } - int sample_rate=sample_rates[ (data[test+2]&0x0C)>>2]>>(lsf+mpeg2); + int sample_rate=sample_rates[ samplerate_index]>>(lsf+mpeg2); int frame_size=0; int temp_frame_size=bitrate_tab[lsf][layer - 1][bitrate_index]; if (layer==1) { -- 2.39.5