resolve merge conflicts of 79cf158 to mnc-dev

AOSP-Change-Id: Ied32e83215e386c801c02991a0b2fa4baa25b643

CVE-2017-0558

(cherry picked from commit 50358a8)

Change-Id: Ic2e40c7d6aec8427444a1fd145726e490e994d08

Author: marcone

media/libstagefright/wifi-display/rtp/RTPSender.cpp

@@ -766,9 +766,15 @@ status_t RTPSender::parseTSFB(const uint8_t *data, size_t size) {
 }
 
 status_t RTPSender::parseAPP(const uint8_t *data, size_t size) {
-    if (!memcmp("late", &data[8], 4)) {
-        int64_t avgLatencyUs = (int64_t)U64_AT(&data[12]);
-        int64_t maxLatencyUs = (int64_t)U64_AT(&data[20]);
+    static const size_t late_offset = 8;
+    static const char late_string[] = "late";
+    static const size_t avgLatencyUs_offset = late_offset + sizeof(late_string) - 1;
+    static const size_t maxLatencyUs_offset = avgLatencyUs_offset + sizeof(int64_t);
+
+    if ((size >= (maxLatencyUs_offset + sizeof(int64_t)))
+            && !memcmp(late_string, &data[late_offset], sizeof(late_string) - 1)) {
+        int64_t avgLatencyUs = (int64_t)U64_AT(&data[avgLatencyUs_offset]);
+        int64_t maxLatencyUs = (int64_t)U64_AT(&data[maxLatencyUs_offset]);
 
         sp<AMessage> notify = mNotify->dup();
         notify->setInt32("what", kWhatInformSender);