Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 027d3020 authored by Aalique Grahame's avatar Aalique Grahame Committed by Arne Coucheron
Browse files

aenc-aac: bounds checking 

Add bounds checking for buffers

CRs-Fixed: 2013236
Change-Id: I0e1f75ea307088b92e87b99f8b614afbcd0f1c82
(cherry picked from commit 9d1af8a2)
parent 9d78a156

mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp

+17 −6
Original line number Diff line number Diff line 
/*--------------------------------------------------------------------------

Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.

Copyright (c) 2010-2014, 2017 The Linux Foundation. All rights reserved.



Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:
@@ -4152,14 +4152,25 @@ OMX_ERRORTYPE omx_aac_aenc::fill_this_buffer_proxy 
            DEBUG_DETAIL("FTBP->Al_len[%d]buf[%p]size[%d]numOutBuf[%d]\n",\

                         buffer->nAllocLen,m_tmp_out_meta_buf,

                         nReadbytes,nNumOutputBuf);

            if(*m_tmp_out_meta_buf <= 0)

            if(m_tmp_out_meta_buf == NULL)

                return OMX_ErrorUndefined;



            if(*m_tmp_out_meta_buf <= 0 || *m_tmp_out_meta_buf > CHAR_MAX)

                return OMX_ErrorBadParameter;

            szadifhr = AUDAAC_MAX_ADIF_HEADER_LENGTH;

            numframes =  *m_tmp_out_meta_buf;

            metainfo  = ((sizeof(ENC_META_OUT) * numframes)+

            metainfo  = (int)((sizeof(ENC_META_OUT) * numframes)+

                sizeof(unsigned char));

            /*

            * add bounds checking

            */

            if ((metainfo > INT_MAX - szadifhr) ||

                (buffer->nAllocLen < (nReadbytes + szadifhr)) ||

                (metainfo > nReadbytes)) {

                return OMX_ErrorBadParameter;

            }

            audaac_rec_install_adif_header_variable(0,sample_idx,

						m_aac_param.nChannels);

                (OMX_U8)m_aac_param.nChannels);

            memcpy(buffer->pBuffer,m_tmp_out_meta_buf,metainfo);

            memcpy(buffer->pBuffer + metainfo,&audaac_header_adif[0],szadifhr);

            memcpy(buffer->pBuffer + metainfo + szadifhr,