From a8dda2393cd86069f9ca6940769efb49fac7e88d Mon Sep 17 00:00:00 2001
From: Ethan Tseng <ettseng@mozilla.com>
Date: Thu, 24 Jul 2014 23:21:25 +0800
Subject: [PATCH] Bug 1038037 - B2G crash when opening malformed MP4A-LATM
 audio streaming over RTSP. r=sworkman

---
 netwerk/protocol/rtsp/rtsp/APacketSource.cpp | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/netwerk/protocol/rtsp/rtsp/APacketSource.cpp b/netwerk/protocol/rtsp/rtsp/APacketSource.cpp
index e0f460d6903b..f8c18c601677 100644
--- a/netwerk/protocol/rtsp/rtsp/APacketSource.cpp
+++ b/netwerk/protocol/rtsp/rtsp/APacketSource.cpp
@@ -215,12 +215,21 @@ static sp<ABuffer> MakeAVCCodecSpecificData(
 }
 
 sp<ABuffer> MakeAACCodecSpecificData(const char *params) {
+    if (!params || !strlen(params)) {
+      return NULL;
+    }
     AString val;
-    CHECK(GetAttribute(params, "config", &val));
+    if (!GetAttribute(params, "config", &val)) {
+        return NULL;
+    }
 
     sp<ABuffer> config = decodeHex(val);
-    CHECK(config != NULL);
-    CHECK_GE(config->size(), 4u);
+    if (!config.get()) {
+      return NULL;
+    }
+    if (config->size() < 4u) {
+      return NULL;
+    }
 
     const uint8_t *data = config->data();
     uint32_t x = data[0] << 24 | data[1] << 16 | data[2] << 8 | data[3];
@@ -476,6 +485,10 @@ APacketSource::APacketSource(
 
         sp<ABuffer> codecSpecificData =
             MakeAACCodecSpecificData(params.c_str());
+        if (!codecSpecificData.get()) {
+            mInitCheck = ERROR_UNSUPPORTED;
+            return;
+        }
 
         mFormat->setData(
                 kKeyESDS, 0,