Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3262f284 authored by Wonsik Kim's avatar Wonsik Kim Committed by android-build-merger
Browse files

Merge "codecs: check OMX buffer size before use in (gsm|g711)dec" into mnc-dev... 

Merge "codecs: check OMX buffer size before use in (gsm|g711)dec" into mnc-dev am: 3cd871d3 am: 20f9cec4 am: f22f681d am: 987974fd
am: 3dc91949

* commit '3dc91949':
  codecs: check OMX buffer size before use in (gsm|g711)dec

Change-Id: Ibe4199a9df71e954ad49565ec7051a148157fe12
parents 2754cb49 3dc91949

media/libstagefright/codecs/g711/dec/SoftG711.cpp

+9 −0
Original line number Diff line number Diff line
@@ -240,6 +240,15 @@ void SoftG711::onQueueFilled(OMX_U32 /* portIndex */) { 
            mSignalledError = true;

        }



        if (inHeader->nFilledLen * sizeof(int16_t) > outHeader->nAllocLen) {

            ALOGE("output buffer too small (%d).", outHeader->nAllocLen);

            android_errorWriteLog(0x534e4554, "27793163");



            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

            mSignalledError = true;

            return;

        }



        const uint8_t *inputptr = inHeader->pBuffer + inHeader->nOffset;



        if (mIsMLaw) {

media/libstagefright/codecs/gsm/dec/SoftGSM.cpp

+8 −0
Original line number Diff line number Diff line
@@ -228,6 +228,14 @@ void SoftGSM::onQueueFilled(OMX_U32 /* portIndex */) { 
            mSignalledError = true;

        }



        if (outHeader->nAllocLen < (inHeader->nFilledLen / kMSGSMFrameSize) * 320) {

            ALOGE("output buffer is not large enough (%d).", outHeader->nAllocLen);

            android_errorWriteLog(0x534e4554, "27793367");

            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

            mSignalledError = true;

            return;

        }



        uint8_t *inputptr = inHeader->pBuffer + inHeader->nOffset;



        int n = mSignalledError ? 0 : DecodeGSM(mGsm,