Merge "libstagefright: Fix crash in convertMetaDataToMessage" into mnc-dev (a7d36c18) · Commits · e / devices / smdk4412 / android_frameworks_av

media/libstagefright/Utils.cpp

+74 −24

Original line number	Diff line number	Diff line
		@@ -70,6 +70,23 @@ uint64_t hton64(uint64_t x) {
		return ((uint64_t)htonl(x & 0xffffffff) << 32) \| htonl(x >> 32);
		}

		static status_t copyNALUToABuffer(sp<ABuffer> buffer, const uint8_t ptr, size_t length) {
		if (((buffer)->size() + 4 + length) > ((buffer)->capacity() - (*buffer)->offset())) {
		sp<ABuffer> tmpBuffer = new (std::nothrow) ABuffer((*buffer)->size() + 4 + length + 1024);
		if (tmpBuffer.get() == NULL \|\| tmpBuffer->base() == NULL) {
		return NO_MEMORY;
		}
		memcpy(tmpBuffer->data(), (buffer)->data(), (buffer)->size());
		tmpBuffer->setRange(0, (*buffer)->size());
		(*buffer) = tmpBuffer;
		}

		memcpy((buffer)->data() + (buffer)->size(), "\x00\x00\x00\x01", 4);
		memcpy((buffer)->data() + (buffer)->size() + 4, ptr, length);
		(buffer)->setRange((buffer)->offset(), (*buffer)->size() + 4 + length);
		return OK;
		}

		status_t convertMetaDataToMessage(
		const sp<MetaData> &meta, sp<AMessage> *format) {
		format->clear();
		@@ -214,7 +231,10 @@ status_t convertMetaDataToMessage(
		ptr += 6;
		size -= 6;

		sp<ABuffer> buffer = new ABuffer(1024);
		sp<ABuffer> buffer = new (std::nothrow) ABuffer(1024);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		buffer->setRange(0, 0);

		for (size_t i = 0; i < numSeqParameterSets; ++i) {
		@@ -224,11 +244,13 @@ status_t convertMetaDataToMessage(
		ptr += 2;
		size -= 2;

		CHECK(size >= length);

		memcpy(buffer->data() + buffer->size(), "\x00\x00\x00\x01", 4);
		memcpy(buffer->data() + buffer->size() + 4, ptr, length);
		buffer->setRange(0, buffer->size() + 4 + length);
		if (size < length) {
		return BAD_VALUE;
		}
		status_t err = copyNALUToABuffer(&buffer, ptr, length);
		if (err != OK) {
		return err;
		}

		ptr += length;
		size -= length;
		@@ -239,7 +261,10 @@ status_t convertMetaDataToMessage(

		msg->setBuffer("csd-0", buffer);

		buffer = new ABuffer(1024);
		buffer = new (std::nothrow) ABuffer(1024);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		buffer->setRange(0, 0);

		CHECK(size >= 1);
		@@ -254,11 +279,13 @@ status_t convertMetaDataToMessage(
		ptr += 2;
		size -= 2;

		CHECK(size >= length);

		memcpy(buffer->data() + buffer->size(), "\x00\x00\x00\x01", 4);
		memcpy(buffer->data() + buffer->size() + 4, ptr, length);
		buffer->setRange(0, buffer->size() + 4 + length);
		if (size < length) {
		return BAD_VALUE;
		}
		status_t err = copyNALUToABuffer(&buffer, ptr, length);
		if (err != OK) {
		return err;
		}

		ptr += length;
		size -= length;
		@@ -283,7 +310,10 @@ status_t convertMetaDataToMessage(
		size -= 1;
		size_t j = 0, i = 0;

		sp<ABuffer> buffer = new ABuffer(1024);
		sp<ABuffer> buffer = new (std::nothrow) ABuffer(1024);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		buffer->setRange(0, 0);

		for (i = 0; i < numofArrays; i++) {
		@@ -303,11 +333,13 @@ status_t convertMetaDataToMessage(
		ptr += 2;
		size -= 2;

		CHECK(size >= length);

		memcpy(buffer->data() + buffer->size(), "\x00\x00\x00\x01", 4);
		memcpy(buffer->data() + buffer->size() + 4, ptr, length);
		buffer->setRange(0, buffer->size() + 4 + length);
		if (size < length) {
		return BAD_VALUE;
		}
		status_t err = copyNALUToABuffer(&buffer, ptr, length);
		if (err != OK) {
		return err;
		}

		ptr += length;
		size -= length;
		@@ -326,7 +358,10 @@ status_t convertMetaDataToMessage(
		esds.getCodecSpecificInfo(
		&codec_specific_data, &codec_specific_data_size);

		sp<ABuffer> buffer = new ABuffer(codec_specific_data_size);
		sp<ABuffer> buffer = new (std::nothrow) ABuffer(codec_specific_data_size);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}

		memcpy(buffer->data(), codec_specific_data,
		codec_specific_data_size);
		@@ -335,7 +370,10 @@ status_t convertMetaDataToMessage(
		buffer->meta()->setInt64("timeUs", 0);
		msg->setBuffer("csd-0", buffer);
		} else if (meta->findData(kKeyVorbisInfo, &type, &data, &size)) {
		sp<ABuffer> buffer = new ABuffer(size);
		sp<ABuffer> buffer = new (std::nothrow) ABuffer(size);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		memcpy(buffer->data(), data, size);

		buffer->meta()->setInt32("csd", true);
		@@ -346,14 +384,20 @@ status_t convertMetaDataToMessage(
		return -EINVAL;
		}

		buffer = new ABuffer(size);
		buffer = new (std::nothrow) ABuffer(size);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		memcpy(buffer->data(), data, size);

		buffer->meta()->setInt32("csd", true);
		buffer->meta()->setInt64("timeUs", 0);
		msg->setBuffer("csd-1", buffer);
		} else if (meta->findData(kKeyOpusHeader, &type, &data, &size)) {
		sp<ABuffer> buffer = new ABuffer(size);
		sp<ABuffer> buffer = new (std::nothrow) ABuffer(size);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		memcpy(buffer->data(), data, size);

		buffer->meta()->setInt32("csd", true);
		@@ -364,7 +408,10 @@ status_t convertMetaDataToMessage(
		return -EINVAL;
		}

		buffer = new ABuffer(size);
		buffer = new (std::nothrow) ABuffer(size);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		memcpy(buffer->data(), data, size);

		buffer->meta()->setInt32("csd", true);
		@@ -375,7 +422,10 @@ status_t convertMetaDataToMessage(
		return -EINVAL;
		}

		buffer = new ABuffer(size);
		buffer = new (std::nothrow) ABuffer(size);
		if (buffer.get() == NULL \|\| buffer->base() == NULL) {
		return NO_MEMORY;
		}
		memcpy(buffer->data(), data, size);

		buffer->meta()->setInt32("csd", true);