Bug 1117486 - [FFOS2.0][Woodduck] System crash by replaying the same RTSP clip several times. r=bechen

netwerk/protocol/rtsp/rtsp/RTSPConnectionHandler.h

@@ -1104,6 +1104,11 @@ struct RtspConnectionHandler : public AHandler {
 
             case kWhatSeek1:
             {
+                if (mAborted || !mSeekPending) {
+                    LOGV("We're aborted, dropping stale packet.");
+                    break;
+                }
+
                 // Session is paused now.
                 for (size_t i = 0; i < mTracks.size(); ++i) {
                     TrackInfo *info = &mTracks.editItemAt(i);
@@ -1136,15 +1141,13 @@ struct RtspConnectionHandler : public AHandler {
 
             case kWhatSeek2:
             {
-                CHECK(mSeekPending);
-
                 int32_t result;
                 CHECK(msg->findInt32("result", &result));
 
                 LOGI("PLAY completed with result %d (%s)",
                      result, strerror(-result));
-                if (mAborted) {
-                  LOGV("we're aborted, dropping stale packet.");
+                if (mAborted || !mSeekPending) {
+                    LOGV("We're aborted, dropping stale packet.");
                     break;
                 }
 

netwerk/protocol/rtsp/rtsp/RTSPSource.cpp

@@ -425,6 +425,10 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatAccessUnitComplete:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping access unit.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -481,6 +485,10 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatEOS:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping end-of-stream message.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -501,6 +509,10 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatSeekDiscontinuity:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping seek discontinuity message.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -521,6 +533,11 @@ void RTSPSource::onMessageReceived(const sp<AMessage> &msg) {
 
         case RtspConnectionHandler::kWhatNormalPlayTimeMapping:
         {
+            if (!isValidState()) {
+                LOGI("We're disconnected, dropping normal play time mapping "
+                     "message.");
+                break;
+            }
             size_t trackIndex;
             CHECK(msg->findSize("trackIndex", &trackIndex));
             CHECK_LT(trackIndex, mTracks.size());
@@ -771,6 +788,15 @@ void RTSPSource::onTrackEndOfStream(size_t trackIndex)
     mListener->OnMediaDataAvailable(trackIndex, data, data.Length(), 0, meta.get());
 }
 
+inline bool RTSPSource::isValidState()
+{
+    if (mState == DISCONNECTED || mTracks.size() == 0) {
+        return false;
+    }
+    return true;
+}
+
+
 
 bool RTSPSource::isLiveStream() {
     int64_t duration = 0;

netwerk/protocol/rtsp/rtsp/RTSPSource.h

@@ -152,6 +152,8 @@ private:
 
     void onTrackEndOfStream(size_t trackIndex);
 
+    inline bool isValidState();
+
     bool isLiveStream();
 
     // This flag is set if we have just disconnected