Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e27e080 authored by Andy Hung's avatar Andy Hung Committed by Bart Sears
Browse files

DO NOT MERGE - IOMX: Add buffer range check to emptyBuffer

Bug: 20634516
Change-Id: If351dbd573bb4aeb6968bfa33f6d407225bc752c
parent dbe6c320
Loading
Loading
Loading
Loading
+6 −0
Original line number Diff line number Diff line
@@ -797,6 +797,12 @@ status_t OMXNodeInstance::emptyBuffer(
    Mutex::Autolock autoLock(mLock);

    OMX_BUFFERHEADERTYPE *header = (OMX_BUFFERHEADERTYPE *)buffer;
    // rangeLength and rangeOffset must be a subset of the allocated data in the buffer.
    // corner case: we permit rangeOffset == end-of-buffer with rangeLength == 0.
    if (rangeOffset > header->nAllocLen
            || rangeLength > header->nAllocLen - rangeOffset) {
        return BAD_VALUE;
    }
    header->nFilledLen = rangeLength;
    header->nOffset = rangeOffset;
    header->nFlags = flags;