From e288880aaf1e952312141471326c5cd3aa22fed5 Mon Sep 17 00:00:00 2001
From: aquilescanta <aquilescanta@google.com>
Date: Tue, 4 Oct 2016 06:57:20 -0700
Subject: [PATCH] Fix Ac3 extractor sniff

Issue:#1875

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=135100986
---
 .../google/android/exoplayer2/audio/Ac3Util.java | 16 +++++++++++++---
 .../exoplayer2/extractor/ts/Ac3Extractor.java    |  3 +++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/library/src/main/java/com/google/android/exoplayer2/audio/Ac3Util.java b/library/src/main/java/com/google/android/exoplayer2/audio/Ac3Util.java
index c2ab70608c..adb3d5999b 100644
--- a/library/src/main/java/com/google/android/exoplayer2/audio/Ac3Util.java
+++ b/library/src/main/java/com/google/android/exoplayer2/audio/Ac3Util.java
@@ -15,6 +15,7 @@
  */
 package com.google.android.exoplayer2.audio;
 
+import com.google.android.exoplayer2.C;
 import com.google.android.exoplayer2.Format;
 import com.google.android.exoplayer2.drm.DrmInitData;
 import com.google.android.exoplayer2.util.MimeTypes;
@@ -175,9 +176,12 @@ public final class Ac3Util {
    * Returns the size in bytes of the given AC-3 syncframe.
    *
    * @param data The syncframe to parse.
-   * @return The syncframe size in bytes.
+   * @return The syncframe size in bytes. {@link C#LENGTH_UNSET} if the input is invalid.
    */
   public static int parseAc3SyncframeSize(byte[] data) {
+    if (data.length < 5) {
+      return C.LENGTH_UNSET;
+    }
     int fscod = (data[4] & 0xC0) >> 6;
     int frmsizecod = data[4] & 0x3F;
     return getAc3SyncframeSize(fscod, frmsizecod);
@@ -227,11 +231,17 @@ public final class Ac3Util {
   }
 
   private static int getAc3SyncframeSize(int fscod, int frmsizecod) {
+    int halfFrmsizecod = frmsizecod / 2;
+    if (fscod < 0 || fscod >= SAMPLE_RATE_BY_FSCOD.length || frmsizecod < 0
+        || halfFrmsizecod >= SYNCFRAME_SIZE_WORDS_BY_HALF_FRMSIZECOD_44_1.length) {
+      // Invalid values provided.
+      return C.LENGTH_UNSET;
+    }
     int sampleRate = SAMPLE_RATE_BY_FSCOD[fscod];
     if (sampleRate == 44100) {
-      return 2 * (SYNCFRAME_SIZE_WORDS_BY_HALF_FRMSIZECOD_44_1[frmsizecod / 2] + (frmsizecod % 2));
+      return 2 * (SYNCFRAME_SIZE_WORDS_BY_HALF_FRMSIZECOD_44_1[halfFrmsizecod] + (frmsizecod % 2));
     }
-    int bitrate = BITRATE_BY_HALF_FRMSIZECOD[frmsizecod / 2];
+    int bitrate = BITRATE_BY_HALF_FRMSIZECOD[halfFrmsizecod];
     if (sampleRate == 32000) {
       return 6 * bitrate;
     } else { // sampleRate == 48000
diff --git a/library/src/main/java/com/google/android/exoplayer2/extractor/ts/Ac3Extractor.java b/library/src/main/java/com/google/android/exoplayer2/extractor/ts/Ac3Extractor.java
index 8d67be4434..979c7244a8 100644
--- a/library/src/main/java/com/google/android/exoplayer2/extractor/ts/Ac3Extractor.java
+++ b/library/src/main/java/com/google/android/exoplayer2/extractor/ts/Ac3Extractor.java
@@ -107,6 +107,9 @@ public final class Ac3Extractor implements Extractor {
           return true;
         }
         int frameSize = Ac3Util.parseAc3SyncframeSize(scratch.data);
+        if (frameSize == C.LENGTH_UNSET) {
+          return false;
+        }
         input.advancePeekPosition(frameSize - 5);
       }
     }