diff --git a/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp b/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp index fbb6598f29726..553be87611f32 100644 --- a/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp +++ b/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp @@ -21,6 +21,7 @@ #include #include #include +#include #include namespace android { @@ -161,7 +162,14 @@ status_t AMRNBDecoder::read( buffer->set_range(0, kNumSamplesPerFrame * sizeof(int16_t)); - CHECK(numBytesRead <= mInputBuffer->range_length()); + if (numBytesRead > mInputBuffer->range_length()) { + // This is bad, should never have happened, but did. Abort now. + + buffer->release(); + buffer = NULL; + + return ERROR_MALFORMED; + } mInputBuffer->set_range( mInputBuffer->range_offset() + numBytesRead,