Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit fb880622 authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-security-11.0.0_r68' of... 

Merge tag 'android-security-11.0.0_r68' of https://android.googlesource.com/platform/frameworks/av into staging/lineage-18.1_merge_android-security-11.0.0_r68

Android Security 11.0.0 Release 68 (9892680)

* tag 'android-security-11.0.0_r68' of https://android.googlesource.com/platform/frameworks/av:
  Fix NuMediaExtractor::readSampleData buffer Handling

Change-Id: I60c2877dd054439dee97520e78d1ebbb37c17b81
parents a8732aa0 53a46c27

media/libstagefright/NuMediaExtractor.cpp

+9 −5
Original line number Original line Diff line number Diff line
@@ -627,9 +627,11 @@ status_t NuMediaExtractor::appendVorbisNumPageSamples( 
        numPageSamples = -1;

        numPageSamples = -1;

    }

    }





    // insert, including accounting for the space used.

    memcpy((uint8_t *)buffer->data() + mbuf->range_length(),

    memcpy((uint8_t *)buffer->data() + mbuf->range_length(),

           &numPageSamples,

           &numPageSamples,

           sizeof(numPageSamples));

           sizeof(numPageSamples));

    buffer->setRange(buffer->offset(), buffer->size() + sizeof(numPageSamples));





    uint32_t type;

    uint32_t type;

    const void *data;

    const void *data;
@@ -678,6 +680,8 @@ status_t NuMediaExtractor::readSampleData(const sp<ABuffer> &buffer) { 




    ssize_t minIndex = fetchAllTrackSamples();

    ssize_t minIndex = fetchAllTrackSamples();





    buffer->setRange(0, 0);     // start with an empty buffer



    if (minIndex < 0) {

    if (minIndex < 0) {

        return ERROR_END_OF_STREAM;

        return ERROR_END_OF_STREAM;

    }

    }
@@ -693,25 +697,25 @@ status_t NuMediaExtractor::readSampleData(const sp<ABuffer> &buffer) { 
        sampleSize += sizeof(int32_t);

        sampleSize += sizeof(int32_t);

    }

    }





    // capacity() is ok since we cleared out the buffer

    if (buffer->capacity() < sampleSize) {

    if (buffer->capacity() < sampleSize) {

        return -ENOMEM;

        return -ENOMEM;

    }

    }





    const size_t srclen = it->mBuffer->range_length();

    const uint8_t *src =

    const uint8_t *src =

        (const uint8_t *)it->mBuffer->data()

        (const uint8_t *)it->mBuffer->data()

            + it->mBuffer->range_offset();

            + it->mBuffer->range_offset();





    memcpy((uint8_t *)buffer->data(), src, it->mBuffer->range_length());

    memcpy((uint8_t *)buffer->data(), src, srclen);

    buffer->setRange(0, srclen);





    status_t err = OK;

    status_t err = OK;

    if (info->mTrackFlags & kIsVorbis) {

    if (info->mTrackFlags & kIsVorbis) {

        // adjusts range when it inserts the extra bits

        err = appendVorbisNumPageSamples(it->mBuffer, buffer);

        err = appendVorbisNumPageSamples(it->mBuffer, buffer);

    }

    }





    if (err == OK) {

        buffer->setRange(0, sampleSize);

    }



    return err;

    return err;

}

}