Merge "Stagefright: Improve parsing in AH263Assembler" into linaro_android_4.0.1

1 files changed, 6 insertions, 6 deletions

diff --git a/media/libstagefright/rtsp/AH263Assembler.cpp b/media/libstagefright/rtsp/AH263Assembler.cpp
index 498295c46e1b..8f286ed67b2c 100644
--- a/media/libstagefright/rtsp/AH263Assembler.cpp
+++ b/media/libstagefright/rtsp/AH263Assembler.cpp
@@ -100,17 +100,17 @@ ARTPAssembler::AssemblyStatus AH263Assembler::addPacket(
     }
 
     unsigned payloadHeader = U16_AT(buffer->data());
-    CHECK_EQ(payloadHeader >> 11, 0u);  // RR=0
     unsigned P = (payloadHeader >> 10) & 1;
     CHECK_EQ((payloadHeader >> 9) & 1, 0u);  // V=0
-    CHECK_EQ((payloadHeader >> 3) & 0x3f, 0u);  // PLEN=0
-    CHECK_EQ(payloadHeader & 7, 0u);  // PEBIT=0
+    unsigned PLEN = (payloadHeader >> 3) & 0x3f;
+    CHECK_LE(PLEN, buffer->size() - 1);
 
     if (P) {
-        buffer->data()[0] = 0x00;
-        buffer->data()[1] = 0x00;
+        buffer->data()[PLEN] = 0x00;
+        buffer->data()[PLEN + 1] = 0x00;
+        buffer->setRange(buffer->offset() + PLEN, buffer->size() - PLEN);
     } else {
-        buffer->setRange(buffer->offset() + 2, buffer->size() - 2);
+        buffer->setRange(buffer->offset() + 2 + PLEN, buffer->size() - 2 - PLEN);
     }
 
     mPackets.push_back(buffer);