Merge "TextDescription: Fix to parse ftab box" into rvc-dev

media/libstagefright/timedtext/TextDescriptions.cpp

@@ -445,51 +445,75 @@ status_t TextDescriptions::extract3GPPGlobalDescriptions(
                     | *(tmpData + 10) << 8 | *(tmpData + 11);
                 parcel->writeInt32(rgba);
 
+                // tx3g box contains class FontTableBox() which extends ftab box
+                // This information is part of the 3gpp Timed Text Format
+                // Specification#: 26.245 / Section: 5.16(Sample Description Format)
+                // https://www.3gpp.org/ftp/Specs/archive/26_series/26.245/
+
                 tmpData += 12;
                 remaining -= 12;
 
-                if (remaining < 2) {
+                if (remaining < 8) {
                     return OK;
                 }
 
-                size_t dataPos = parcel->dataPosition();
+                size_t subChunkSize = U32_AT(tmpData);
+                if(remaining < subChunkSize) {
+                    return OK;
+                }
 
-                parcel->writeInt32(KEY_STRUCT_FONT_LIST);
+                uint32_t subChunkType = U32_AT(tmpData + 4);
-                uint16_t count = U16_AT(tmpData);
-                parcel->writeInt32(count);
 
-                tmpData += 2;
+                if (subChunkType == FOURCC('f', 't', 'a', 'b'))
-                remaining -= 2;
+                {
+                    tmpData += 8;
+                    size_t subChunkRemaining = subChunkSize - 8;
 
-                for (int i = 0; i < count; i++) {
+                    if(subChunkRemaining < 2) {
-                    if (remaining < 3) {
-                        // roll back
-                        parcel->setDataPosition(dataPos);
                         return OK;
                     }
-                    // font ID
+                    size_t dataPos = parcel->dataPosition();
-                    parcel->writeInt32(U16_AT(tmpData));
 
-                    // font name length
+                    parcel->writeInt32(KEY_STRUCT_FONT_LIST);
-                    parcel->writeInt32(*(tmpData + 2));
+                    uint16_t count = U16_AT(tmpData);
+                    parcel->writeInt32(count);
 
-                    size_t len = *(tmpData + 2);
+                    tmpData += 2;
+                    subChunkRemaining -= 2;
 
-                    tmpData += 3;
+                    for (int i = 0; i < count; i++) {
-                    remaining -= 3;
+                        if (subChunkRemaining < 3) {
+                            // roll back
+                            parcel->setDataPosition(dataPos);
+                            return OK;
+                        }
+                        // font ID
+                        parcel->writeInt32(U16_AT(tmpData));
 
-                    if (remaining < len) {
+                        // font name length
-                        // roll back
+                        size_t len = *(tmpData + 2);
-                        parcel->setDataPosition(dataPos);
-                        return OK;
-                    }
 
-                    parcel->write(tmpData, len);
+                        parcel->writeInt32(len);
-                    tmpData += len;
+
-                    remaining -= len;
+                        tmpData += 3;
-                }
+                        subChunkRemaining -=3;
 
-                // there is a "DisparityBox" after this according to the spec, but we ignore it
+                        if (subChunkRemaining < len) {
+                            // roll back
+                            parcel->setDataPosition(dataPos);
+                            return OK;
+                        }
+
+                        parcel->write(tmpData, len);
+                        tmpData += len;
+                        subChunkRemaining -= len;
+                    }
+                    tmpData += subChunkRemaining;
+                    remaining -= subChunkSize;
+                } else {
+                    tmpData += subChunkSize;
+                    remaining -= subChunkSize;
+                }
                 break;
             }
             default: