зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1353088: Ensure we don't attempt to process garbage data. r=gerald
MozReview-Commit-ID: AryC34eLjOg
This commit is contained in:
Родитель
0a9bd728a5
Коммит
efb450b903
|
@ -902,16 +902,27 @@ void
|
||||||
TrackBuffersManager::InitializationSegmentReceived()
|
TrackBuffersManager::InitializationSegmentReceived()
|
||||||
{
|
{
|
||||||
MOZ_ASSERT(mParser->HasCompleteInitData());
|
MOZ_ASSERT(mParser->HasCompleteInitData());
|
||||||
|
|
||||||
|
int64_t endInit = mParser->InitSegmentRange().mEnd;
|
||||||
|
if (mInputBuffer->Length() > mProcessedInput ||
|
||||||
|
int64_t(mProcessedInput - mInputBuffer->Length()) > endInit) {
|
||||||
|
// Something is not quite right with the data appended. Refuse it.
|
||||||
|
RejectAppend(MediaResult(NS_ERROR_FAILURE,
|
||||||
|
"Invalid state following initialization segment"),
|
||||||
|
__func__);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
mCurrentInputBuffer = new SourceBufferResource(mType);
|
mCurrentInputBuffer = new SourceBufferResource(mType);
|
||||||
// The demuxer isn't initialized yet ; we don't want to notify it
|
// The demuxer isn't initialized yet ; we don't want to notify it
|
||||||
// that data has been appended yet ; so we simply append the init segment
|
// that data has been appended yet ; so we simply append the init segment
|
||||||
// to the resource.
|
// to the resource.
|
||||||
mCurrentInputBuffer->AppendData(mParser->InitData());
|
mCurrentInputBuffer->AppendData(mParser->InitData());
|
||||||
uint32_t length =
|
uint32_t length = endInit - (mProcessedInput - mInputBuffer->Length());
|
||||||
mParser->InitSegmentRange().mEnd - (mProcessedInput - mInputBuffer->Length());
|
|
||||||
if (mInputBuffer->Length() == length) {
|
if (mInputBuffer->Length() == length) {
|
||||||
mInputBuffer = nullptr;
|
mInputBuffer = nullptr;
|
||||||
} else {
|
} else {
|
||||||
|
MOZ_RELEASE_ASSERT(length <= mInputBuffer->Length());
|
||||||
mInputBuffer->RemoveElementsAt(0, length);
|
mInputBuffer->RemoveElementsAt(0, length);
|
||||||
}
|
}
|
||||||
CreateDemuxerforMIMEType();
|
CreateDemuxerforMIMEType();
|
||||||
|
|
|
@ -234,7 +234,7 @@ private:
|
||||||
RefPtr<SourceBufferResource> mCurrentInputBuffer;
|
RefPtr<SourceBufferResource> mCurrentInputBuffer;
|
||||||
RefPtr<MediaDataDemuxer> mInputDemuxer;
|
RefPtr<MediaDataDemuxer> mInputDemuxer;
|
||||||
// Length already processed in current media segment.
|
// Length already processed in current media segment.
|
||||||
uint32_t mProcessedInput;
|
uint64_t mProcessedInput;
|
||||||
Maybe<media::TimeUnit> mLastParsedEndTime;
|
Maybe<media::TimeUnit> mLastParsedEndTime;
|
||||||
|
|
||||||
void OnDemuxerInitDone(nsresult);
|
void OnDemuxerInitDone(nsresult);
|
||||||
|
|
Загрузка…
Ссылка в новой задаче