diff --git a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp index 3a3bf161c207..5fe686c13956 100644 --- a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp @@ -3497,7 +3497,14 @@ status_t MPEG4Source::read( // Each NAL unit is split up into its constituent fragments and // each one of them returned in its own buffer. - CHECK(mBuffer->range_length() >= mNALLengthSize); + if (mBuffer->range_length() < mNALLengthSize) { + ALOGE("incomplete NAL unit."); + + mBuffer->release(); + mBuffer = NULL; + + return ERROR_MALFORMED; + } const uint8_t *src = (const uint8_t *)mBuffer->data() + mBuffer->range_offset(); @@ -3859,7 +3866,14 @@ status_t MPEG4Source::fragmentedRead( // Each NAL unit is split up into its constituent fragments and // each one of them returned in its own buffer. - CHECK(mBuffer->range_length() >= mNALLengthSize); + if (mBuffer->range_length() < mNALLengthSize) { + ALOGE("incomplete NAL unit."); + + mBuffer->release(); + mBuffer = NULL; + + return ERROR_MALFORMED; + } const uint8_t *src = (const uint8_t *)mBuffer->data() + mBuffer->range_offset();