Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e79910f authored by Dongwon Kang's avatar Dongwon Kang
Browse files

Check buffer size in useBuffer in software components 

Test: No more crash from oob read/write with running poc.
Bug: 63522430
Change-Id: I232d256eacdfaa9347902fe9b42650999f0d2d85
parent 5c57e911

media/libstagefright/omx/SimpleSoftOMXComponent.cpp

+7 −2
Original line number Diff line number Diff line
@@ -199,6 +199,13 @@ OMX_ERRORTYPE SimpleSoftOMXComponent::useBuffer( 
    Mutex::Autolock autoLock(mLock);

    CHECK_LT(portIndex, mPorts.size());



    PortInfo *port = &mPorts.editItemAt(portIndex);

    if (size < port->mDef.nBufferSize) {

        ALOGE("b/63522430, Buffer size is too small.");

        android_errorWriteLog(0x534e4554, "63522430");

        return OMX_ErrorBadParameter;

    }



    *header = new OMX_BUFFERHEADERTYPE;

    (*header)->nSize = sizeof(OMX_BUFFERHEADERTYPE);

    (*header)->nVersion.s.nVersionMajor = 1;
@@ -221,8 +228,6 @@ OMX_ERRORTYPE SimpleSoftOMXComponent::useBuffer( 
    (*header)->nOutputPortIndex = portIndex;

    (*header)->nInputPortIndex = portIndex;



    PortInfo *port = &mPorts.editItemAt(portIndex);



    CHECK(mState == OMX_StateLoaded || port->mDef.bEnabled == OMX_FALSE);



    CHECK_LT(port->mBuffers.size(), port->mDef.nBufferCountActual);