From 281f9695163b83e5b1609742212806b3fa21142c Mon Sep 17 00:00:00 2001
From: Ruchika Ashtankar <ruchika.ashtankar@ittiam.com>
Date: Thu, 5 Mar 2020 19:39:01 +0530
Subject: [PATCH] TextDescription: Fix to parse ftab box

Test: atest TimedTextUnitTest -- --enable-module-dynamic-download=true

Bug: 150915309

Change-Id: I4b1c61661948f5613cf6dccbbcf4367bd6a291c7
Merged-In: I4b1c61661948f5613cf6dccbbcf4367bd6a291c7
---
 .../timedtext/TextDescriptions.cpp            | 80 ++++++++++++-------
 1 file changed, 52 insertions(+), 28 deletions(-)

diff --git a/media/libstagefright/timedtext/TextDescriptions.cpp b/media/libstagefright/timedtext/TextDescriptions.cpp
index 0dc7722f6f..6c94754f56 100644
--- a/media/libstagefright/timedtext/TextDescriptions.cpp
+++ b/media/libstagefright/timedtext/TextDescriptions.cpp
@@ -445,51 +445,75 @@ status_t TextDescriptions::extract3GPPGlobalDescriptions(
                     | *(tmpData + 10) << 8 | *(tmpData + 11);
                 parcel->writeInt32(rgba);
 
+                // tx3g box contains class FontTableBox() which extends ftab box
+                // This information is part of the 3gpp Timed Text Format
+                // Specification#: 26.245 / Section: 5.16(Sample Description Format)
+                // https://www.3gpp.org/ftp/Specs/archive/26_series/26.245/
+
                 tmpData += 12;
                 remaining -= 12;
 
-                if (remaining < 2) {
+                if (remaining < 8) {
                     return OK;
                 }
 
-                size_t dataPos = parcel->dataPosition();
+                size_t subChunkSize = U32_AT(tmpData);
+                if(remaining < subChunkSize) {
+                    return OK;
+                }
 
-                parcel->writeInt32(KEY_STRUCT_FONT_LIST);
-                uint16_t count = U16_AT(tmpData);
-                parcel->writeInt32(count);
+                uint32_t subChunkType = U32_AT(tmpData + 4);
 
-                tmpData += 2;
-                remaining -= 2;
+                if (subChunkType == FOURCC('f', 't', 'a', 'b'))
+                {
+                    tmpData += 8;
+                    size_t subChunkRemaining = subChunkSize - 8;
 
-                for (int i = 0; i < count; i++) {
-                    if (remaining < 3) {
-                        // roll back
-                        parcel->setDataPosition(dataPos);
+                    if(subChunkRemaining < 2) {
                         return OK;
                     }
-                    // font ID
-                    parcel->writeInt32(U16_AT(tmpData));
+                    size_t dataPos = parcel->dataPosition();
 
-                    // font name length
-                    parcel->writeInt32(*(tmpData + 2));
+                    parcel->writeInt32(KEY_STRUCT_FONT_LIST);
+                    uint16_t count = U16_AT(tmpData);
+                    parcel->writeInt32(count);
 
-                    size_t len = *(tmpData + 2);
+                    tmpData += 2;
+                    subChunkRemaining -= 2;
 
-                    tmpData += 3;
-                    remaining -= 3;
+                    for (int i = 0; i < count; i++) {
+                        if (subChunkRemaining < 3) {
+                            // roll back
+                            parcel->setDataPosition(dataPos);
+                            return OK;
+                        }
+                        // font ID
+                        parcel->writeInt32(U16_AT(tmpData));
 
-                    if (remaining < len) {
-                        // roll back
-                        parcel->setDataPosition(dataPos);
-                        return OK;
-                    }
+                        // font name length
+                        size_t len = *(tmpData + 2);
 
-                    parcel->write(tmpData, len);
-                    tmpData += len;
-                    remaining -= len;
-                }
+                        parcel->writeInt32(len);
+
+                        tmpData += 3;
+                        subChunkRemaining -=3;
 
-                // there is a "DisparityBox" after this according to the spec, but we ignore it
+                        if (subChunkRemaining < len) {
+                            // roll back
+                            parcel->setDataPosition(dataPos);
+                            return OK;
+                        }
+
+                        parcel->write(tmpData, len);
+                        tmpData += len;
+                        subChunkRemaining -= len;
+                    }
+                    tmpData += subChunkRemaining;
+                    remaining -= subChunkSize;
+                } else {
+                    tmpData += subChunkSize;
+                    remaining -= subChunkSize;
+                }
                 break;
             }
             default: