Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e14b5e6 authored by Abubakar Alkali's avatar Abubakar Alkali Committed by Automerger Merge Worker
Browse files

Merge "OMXNodeInstance: Validate size of structures" into rvc-dev am:... 

Merge "OMXNodeInstance: Validate size of structures" into rvc-dev am: 5dc701f9 am: e6ca6072 am: c53d2498 am: 838ea74d am: 5d527393 am: 2e860a5a am: bf772136 am: c73ad614

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/25545466



Change-Id: I085a9bdf1b4ea4bd7a8f637c317b2ef1cb672b82
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 7b811a81 c73ad614

media/libstagefright/omx/OMXNodeInstance.cpp

+38 −1
Original line number Diff line number Diff line
@@ -102,6 +102,21 @@ static const OMX_U32 kPortIndexOutput = 1; 


namespace android {



static bool isValidOmxParamSize(const void *params, OMX_U32 size) {

    // expect the vector to contain at least the size and version, two OMX_U32 entries.

    if (size < 2 * sizeof(OMX_U32)) {

        return false;

    }



    // expect the vector to be as large as the declared size

    OMX_U32 *buf = (OMX_U32 *)params;

    OMX_U32 declaredSize = *(OMX_U32*)buf;

    if (declaredSize > size) {

        return false;

    }

    return true;

}



struct BufferMeta {

    explicit BufferMeta(

            const sp<IMemory> &mem, const sp<IHidlMemory> &hidlMemory,
@@ -688,6 +703,18 @@ bool OMXNodeInstance::isProhibitedIndex_l(OMX_INDEXTYPE index) { 


status_t OMXNodeInstance::getParameter(

        OMX_INDEXTYPE index, void *params, size_t size) {

    OMX_INDEXEXTTYPE extIndex = (OMX_INDEXEXTTYPE)index;

    if (extIndex == OMX_IndexParamConsumerUsageBits) {

        // expect the size to be 4 bytes for OMX_IndexParamConsumerUsageBits

        if (size != sizeof(OMX_U32)) {

            return BAD_VALUE;

        }

    } else {

        if (!isValidOmxParamSize(params, size)) {

            return BAD_VALUE;

        }

    }



    Mutex::Autolock autoLock(mLock);

    if (mHandle == NULL) {

        return DEAD_OBJECT;
@@ -699,7 +726,6 @@ status_t OMXNodeInstance::getParameter( 
    }



    OMX_ERRORTYPE err = OMX_GetParameter(mHandle, index, params);

    OMX_INDEXEXTTYPE extIndex = (OMX_INDEXEXTTYPE)index;

    // some errors are expected for getParameter

    if (err != OMX_ErrorNoMore) {

        CLOG_IF_ERROR(getParameter, err, "%s(%#x)", asString(extIndex), index);
@@ -710,6 +736,10 @@ status_t OMXNodeInstance::getParameter( 


status_t OMXNodeInstance::setParameter(

        OMX_INDEXTYPE index, const void *params, size_t size) {

    if (!isValidOmxParamSize(params, size)) {

        return BAD_VALUE;

    }



    Mutex::Autolock autoLock(mLock);

    if (mHandle == NULL) {

        return DEAD_OBJECT;
@@ -736,6 +766,9 @@ status_t OMXNodeInstance::setParameter( 


status_t OMXNodeInstance::getConfig(

        OMX_INDEXTYPE index, void *params, size_t size) {

    if (!isValidOmxParamSize(params, size)) {

        return BAD_VALUE;

    }

    Mutex::Autolock autoLock(mLock);

    if (mHandle == NULL) {

        return DEAD_OBJECT;
@@ -759,6 +792,10 @@ status_t OMXNodeInstance::getConfig( 


status_t OMXNodeInstance::setConfig(

        OMX_INDEXTYPE index, const void *params, size_t size) {

    if (!isValidOmxParamSize(params, size)) {

        return BAD_VALUE;

    }



    Mutex::Autolock autoLock(mLock);

    if (mHandle == NULL) {

        return DEAD_OBJECT;