Merge "C2SurfaceSyncObj: prevent OOB read in Import" into tm-qpr-dev (620318fb) · Commits · e / os / android_frameworks_av

media/codec2/vndk/platform/C2SurfaceSyncObj.cpp

+5 −0

Original line number	Diff line number	Diff line
		@@ -64,6 +64,11 @@ std::shared_ptr<C2SurfaceSyncMemory> C2SurfaceSyncMemory::Import(
		}

		HandleSyncMem o = static_cast<HandleSyncMem>(handle);
		if (o->size() < sizeof(C2SyncVariables)) {
		android_errorWriteLog(0x534e4554, "240140929");
		return nullptr;
		}

		void *ptr = mmap(NULL, o->size(), PROT_READ \| PROT_WRITE, MAP_SHARED, o->memFd(), 0);

		if (ptr == MAP_FAILED) {