Merge "DO NOT MERGE codecs: check OMX buffer size before use in VP8 encoder." into klp-dev (4f998235) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+21 −5

Original line number	Diff line number	Diff line
		@@ -824,6 +824,7 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) {
		uint8_t *source =
		inputBufferHeader->pBuffer + inputBufferHeader->nOffset;

		size_t frameSize = mWidth * mHeight * 3 / 2;
		if (mInputDataIsMeta) {
		CHECK_GE(inputBufferHeader->nFilledLen,
		4 + sizeof(buffer_handle_t));
		@@ -855,12 +856,22 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) {
		source = mConversionBuffer;

		CHECK_EQ(0, grmodule->unlock(grmodule, handle));
		} else if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {
		} else {
		if (inputBufferHeader->nFilledLen < frameSize) {
		android_errorWriteLog(0x534e4554, "27569635");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);
		return;
		} else if (inputBufferHeader->nFilledLen > frameSize) {
		ALOGW("Input buffer contains too many pixels");
		}

		if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {
		ConvertSemiPlanarToPlanar(
		source, mConversionBuffer, mWidth, mHeight);

		source = mConversionBuffer;
		}
		}
		vpx_image_t raw_frame;
		vpx_img_wrap(&raw_frame, VPX_IMG_FMT_I420, mWidth, mHeight,
		kInputBufferAlignment, source);
		@@ -914,6 +925,11 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) {
		outputBufferHeader->nFlags \|= OMX_BUFFERFLAG_SYNCFRAME;
		outputBufferHeader->nOffset = 0;
		outputBufferHeader->nFilledLen = encoded_packet->data.frame.sz;
		if (outputBufferHeader->nFilledLen > outputBufferHeader->nAllocLen) {
		android_errorWriteLog(0x534e4554, "27569635");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);
		return;
		}
		memcpy(outputBufferHeader->pBuffer,
		encoded_packet->data.frame.buf,
		encoded_packet->data.frame.sz);