Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e8e1345 authored by Wei Jia's avatar Wei Jia Committed by android-build-merger
Browse files

DO NOT MERGE - libstagefright: check requested memory size before allocation... 

DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
am: 04629752

* commit '04629752':
  DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
parents 313358c7 04629752

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

+9 −0
Original line number Diff line number Diff line
@@ -35,6 +35,10 @@ 


#include <inttypes.h>



#ifndef INT32_MAX

#define INT32_MAX   2147483647

#endif



namespace android {



template<class T>
@@ -123,6 +127,11 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { 
            || mStoreMetaDataInBuffers) {

        // Color conversion is needed.

        free(mInputFrameData);

        mInputFrameData = NULL;

        if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) {

            ALOGE("b/25812794, Buffer size is too big.");

            return OMX_ErrorBadParameter;

        }

        mInputFrameData =

            (uint8_t *) malloc((mVideoWidth * mVideoHeight * 3 ) >> 1);

        CHECK(mInputFrameData != NULL);

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+9 −0
Original line number Diff line number Diff line
@@ -25,6 +25,10 @@ 
#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/MediaDefs.h>



#ifndef INT32_MAX

#define INT32_MAX   2147483647

#endif



namespace android {



template<class T>
@@ -369,6 +373,11 @@ status_t SoftVPXEncoder::initEncoder() { 


    if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) {

        free(mConversionBuffer);

        mConversionBuffer = NULL;

        if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) {

            ALOGE("b/25812794, Buffer size is too big.");

            return UNKNOWN_ERROR;

        }

        mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2);

        if (mConversionBuffer == NULL) {

            ALOGE("Allocating conversion buffer failed.");