AMPEG4ElementaryAssembler: reject malformed desc

Bug: 124777537
Test: (1) python rtsp_server2.py $server_addr
Test: (2) adb shell am start -a android.intent.action.VIEW
  -n com.google.android.apps.photos/.pager.HostPhotoPagerActivity
  -t video/'*' -d rtsp://$server_addr/a.mp4
Change-Id: Iacc6882819e0d99ffdab409324301e8f8d8125f7

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.cpp

@@ -203,6 +203,14 @@ struct AUHeader {
     unsigned mSerial;
 };
 
+bool AMPEG4ElementaryAssembler::initCheck() {
+    if(mSizeLength == 0 || mIndexLength == 0 || mIndexDeltaLength == 0) {
+        android_errorWriteLog(0x534e4554, "124777537");
+        return false;
+    }
+    return true;
+}
+
 ARTPAssembler::AssemblyStatus AMPEG4ElementaryAssembler::addPacket(
         const sp<ARTPSource> &source) {
     List<sp<ABuffer> > *queue = source->queue();

media/libstagefright/rtsp/AMPEG4ElementaryAssembler.h

@@ -36,6 +36,7 @@ struct AMPEG4ElementaryAssembler : public ARTPAssembler {
     AMPEG4ElementaryAssembler(
             const sp<AMessage> &notify, const AString &desc,
             const AString &params);
+    virtual bool initCheck();
 
 protected:
     virtual ~AMPEG4ElementaryAssembler();

media/libstagefright/rtsp/ARTPAssembler.h

@@ -39,6 +39,7 @@ struct ARTPAssembler : public RefBase {
 
     void onPacketReceived(const sp<ARTPSource> &source);
     virtual void onByeReceived() = 0;
+    virtual bool initCheck() { return true; }
 
 protected:
     virtual AssemblyStatus assembleMore(const sp<ARTPSource> &source) = 0;

media/libstagefright/rtsp/ARTPSource.cpp

@@ -82,6 +82,10 @@ ARTPSource::ARTPSource(
     } else {
         TRESPASS();
     }
+
+    if (mAssembler != NULL && !mAssembler->initCheck()) {
+        mAssembler.clear();
+    }
 }
 
 static uint32_t AbsDiff(uint32_t seq1, uint32_t seq2) {
@@ -89,7 +93,7 @@ static uint32_t AbsDiff(uint32_t seq1, uint32_t seq2) {
 }
 
 void ARTPSource::processRTPPacket(const sp<ABuffer> &buffer) {
-    if (queuePacket(buffer) && mAssembler != NULL) {
+    if (mAssembler != NULL && queuePacket(buffer)) {
         mAssembler->onPacketReceived(this);
     }
 }
@@ -171,7 +175,9 @@ bool ARTPSource::queuePacket(const sp<ABuffer> &buffer) {
 }
 
 void ARTPSource::byeReceived() {
-    mAssembler->onByeReceived();
+    if (mAssembler != NULL) {
+        mAssembler->onByeReceived();
+    }
 }
 
 void ARTPSource::addFIR(const sp<ABuffer> &buffer) {