From 147deafd01e18621cb5221132f0e39598ceeb186 Mon Sep 17 00:00:00 2001
From: aquilescanta <aquilescanta@google.com>
Date: Mon, 7 Jan 2019 12:36:59 +0000
Subject: [PATCH] Increase search size in mp4 sniffing once moov has been found

Issue:#5320
PiperOrigin-RevId: 228142567
---
 .../exoplayer2/extractor/mp4/Sniffer.java     | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/library/core/src/main/java/com/google/android/exoplayer2/extractor/mp4/Sniffer.java b/library/core/src/main/java/com/google/android/exoplayer2/extractor/mp4/Sniffer.java
index 657a955ab4..a1c90bf1f2 100644
--- a/library/core/src/main/java/com/google/android/exoplayer2/extractor/mp4/Sniffer.java
+++ b/library/core/src/main/java/com/google/android/exoplayer2/extractor/mp4/Sniffer.java
@@ -27,9 +27,7 @@ import java.io.IOException;
  */
 /* package */ final class Sniffer {
 
-  /**
-   * The maximum number of bytes to peek when sniffing.
-   */
+  /** The maximum number of bytes to peek when sniffing. */
   private static final int SEARCH_LENGTH = 4 * 1024;
 
   private static final int[] COMPATIBLE_BRANDS = new int[] {
@@ -112,12 +110,16 @@ import java.io.IOException;
         atomSize = buffer.readLong();
       } else if (atomSize == Atom.EXTENDS_TO_END_SIZE) {
         // The atom extends to the end of the file.
-        long endPosition = input.getLength();
-        if (endPosition != C.LENGTH_UNSET) {
-          atomSize = endPosition - input.getPeekPosition() + headerSize;
+        long fileEndPosition = input.getLength();
+        if (fileEndPosition != C.LENGTH_UNSET) {
+          atomSize = fileEndPosition - input.getPeekPosition() + headerSize;
         }
       }
 
+      if (inputLength != C.LENGTH_UNSET && bytesSearched + atomSize > inputLength) {
+        // The file is invalid because the atom extends past the end of the file.
+        return false;
+      }
       if (atomSize < headerSize) {
         // The file is invalid because the atom size is too small for its header.
         return false;
@@ -125,6 +127,13 @@ import java.io.IOException;
       bytesSearched += headerSize;
 
       if (atomType == Atom.TYPE_moov) {
+        // We have seen the moov atom. We increase the search size to make sure we don't miss an
+        // mvex atom because the moov's size exceeds the search length.
+        bytesToSearch += (int) atomSize;
+        if (inputLength != C.LENGTH_UNSET && bytesToSearch > inputLength) {
+          // Make sure we don't exceed the file size.
+          bytesToSearch = (int) inputLength;
+        }
         // Check for an mvex atom inside the moov atom to identify whether the file is fragmented.
         continue;
       }