Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 33c87057 authored by Gopalakrishnan Nallasamy's avatar Gopalakrishnan Nallasamy
Browse files

FrameDecoder:Return error if dimension is missing 

 Decoding non-8-bit or other non-YUV-420 vendor specific pixel
formats causes abort as stride is not present in such cases.
Malicious app can bring down media server by getting a thumbnail from
a 10-bit file.  Hence, if the stride is missing in the format, return
error message instead of aborting.
Handle missing height or width dimensions the same as above.

Bug: 192085013

Test: atest android.media.cts.MediaMetadataRetrieverTest
Change-Id: I3a0cf7d2ff60f378497a27aac43eb839f732fc5a
parent fbdfa069

media/libstagefright/FrameDecoder.cpp

+12 −3
Original line number Diff line number Diff line
@@ -883,9 +883,18 @@ status_t MediaImageDecoder::onOutputReceived( 
    }



    int32_t width, height, stride;

    CHECK(outputFormat->findInt32("width", &width));

    CHECK(outputFormat->findInt32("height", &height));

    CHECK(outputFormat->findInt32("stride", &stride));

    if (outputFormat->findInt32("width", &width) == false) {

        ALOGE("MediaImageDecoder::onOutputReceived:width is missing in outputFormat");

        return ERROR_MALFORMED;

    }

    if (outputFormat->findInt32("height", &height) == false) {

        ALOGE("MediaImageDecoder::onOutputReceived:height is missing in outputFormat");

        return ERROR_MALFORMED;

    }

    if (outputFormat->findInt32("stride", &stride) == false) {

        ALOGE("MediaImageDecoder::onOutputReceived:stride is missing in outputFormat");

        return ERROR_MALFORMED;

    }



    if (mFrame == NULL) {

        sp<IMemory> frameMem = allocVideoFrame(