Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 20297c91 authored by Wonsik Kim's avatar Wonsik Kim Committed by Jessica Wagantall
Browse files

codecs: check OMX buffer size before use in hevcdec 

Bug: 27833616
Ticket: CYNGNOS-2707
Change-Id: Ic4045a3f56f53b08d0b1264b2a91b8f43e91b738
(cherry picked from commit 1e9c0558)
parent 73d0aa2a

media/libstagefright/codecs/hevcdec/SoftHEVC.cpp

+18 −9
Original line number Diff line number Diff line
@@ -478,14 +478,13 @@ OMX_ERRORTYPE SoftHEVC::internalSetParameter(OMX_INDEXTYPE index, const OMX_PTR 
    return ret;

}



void SoftHEVC::setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,

bool SoftHEVC::setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,

        ivd_video_decode_op_t *ps_dec_op,

        OMX_BUFFERHEADERTYPE *inHeader,

        OMX_BUFFERHEADERTYPE *outHeader,

        size_t timeStampIx) {

    size_t sizeY = outputBufferWidth() * outputBufferHeight();

    size_t sizeUV;

    uint8_t *pBuf;



    ps_dec_ip->u4_size = sizeof(ivd_video_decode_ip_t);

    ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
@@ -505,22 +504,28 @@ void SoftHEVC::setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip, 
        ps_dec_ip->u4_num_Bytes = 0;

    }



    sizeUV = sizeY / 4;

    ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;

    ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;

    ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;



    uint8_t *pBuf;

    if (outHeader) {

        if (outHeader->nAllocLen < sizeY + (sizeUV * 2)) {

            android_errorWriteLog(0x534e4554, "27833616");

            return false;

        }

        pBuf = outHeader->pBuffer;

    } else {

        // mFlushOutBuffer always has the right size.

        pBuf = mFlushOutBuffer;

    }



    sizeUV = sizeY / 4;

    ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;

    ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;

    ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;



    ps_dec_ip->s_out_buffer.pu1_bufs[0] = pBuf;

    ps_dec_ip->s_out_buffer.pu1_bufs[1] = pBuf + sizeY;

    ps_dec_ip->s_out_buffer.pu1_bufs[2] = pBuf + sizeY + sizeUV;

    ps_dec_ip->s_out_buffer.u4_num_bufs = 3;

    return;

    return true;

}

void SoftHEVC::onPortFlushCompleted(OMX_U32 portIndex) {

    /* Once the output buffers are flushed, ignore any buffers that are held in decoder */
@@ -635,7 +640,11 @@ void SoftHEVC::onQueueFilled(OMX_U32 portIndex) { 
            WORD32 timeDelay, timeTaken;

            size_t sizeY, sizeUV;



            setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx);

            if (!setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx)) {

                ALOGE("Decoder arg setup failed");

                notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

                return;

            }



            GETTIME(&mTimeStart, NULL);

            /* Compute time elapsed between end of previous decode()

media/libstagefright/codecs/hevcdec/SoftHEVC.h

+1 −1
Original line number Diff line number Diff line
@@ -111,7 +111,7 @@ private: 
    status_t resetPlugin();

    status_t reInitDecoder();



    void setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,

    bool setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,

        ivd_video_decode_op_t *ps_dec_op,

        OMX_BUFFERHEADERTYPE *inHeader,

        OMX_BUFFERHEADERTYPE *outHeader,