Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b0d94aa authored by Pawin Vongmasa's avatar Pawin Vongmasa
Browse files

Check the buffer index from acquireBuffer 

Test: Run the POC
Test: Small CtsMediaTestCases
Bug: 37563942
Merged-In: I8ddfbc91a08d96de1f732e6776d6f90997042f6b
Change-Id: I8ddfbc91a08d96de1f732e6776d6f90997042f6b
parent eb36bac9

media/libstagefright/omx/GraphicBufferSource.cpp

+18 −2
Original line number Diff line number Diff line
@@ -482,6 +482,12 @@ void GraphicBufferSource::suspend(bool suspend) { 
            } else if (err != OK) {

                ALOGW("suspend: acquireBuffer returned err=%d", err);

                break;

            } else if (item.mSlot < 0 ||

                    item.mSlot >= BufferQueue::NUM_BUFFER_SLOTS) {

                // Invalid buffer index

                ALOGW("suspend: corrupted buffer index (%d)",

                        item.mSlot);

                break;

            }



            ++mNumBufferAcquired;
@@ -603,6 +609,10 @@ bool GraphicBufferSource::fillCodecBuffer_l() { 
        // now what? fake end-of-stream?

        ALOGW("fillCodecBuffer_l: acquireBuffer returned err=%d", err);

        return false;

    } else if (item.mSlot < 0 || item.mSlot >= BufferQueue::NUM_BUFFER_SLOTS) {

        // Invalid buffer index

        ALOGW("fillCodecBuffer_l: corrupted buffer index (%d)", item.mSlot);

        return false;

    }



    mNumBufferAcquired++;
@@ -962,8 +972,14 @@ void GraphicBufferSource::onFrameAvailable(const BufferItem& /*item*/) { 
        BufferItem item;

        status_t err = mConsumer->acquireBuffer(&item, 0);

        if (err == OK) {

            if (item.mSlot < 0 ||

                    item.mSlot >= BufferQueue::NUM_BUFFER_SLOTS) {

                // Invalid buffer index

                ALOGW("onFrameAvailable: corrupted buffer index (%d)",

                        item.mSlot);

                return;

            }

            mNumBufferAcquired++;



            // If this is the first time we're seeing this buffer, add it to our

            // slot table.

            if (item.mGraphicBuffer != NULL) {