Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 6905352f authored by Shrikara B's avatar Shrikara B Committed by Michael Bestas
Browse files

CCodec: Avoid OOB memory access in some cases 

During releaseBuffer, if the caller has not provided
pointer to c2buffer, then no need to generate compBuffer,
if doesn't exist already.

If the raw color format is not recognized by frameworks,
then ImageCopy (inside asC2Buffer function) might end up
resulting in out-of-bound memory access for few resolutions

CRs-Fixed: 3341384
Change-Id: I39b06a571e6244931c73ef99675f4d9e2dcf247e
parent bdafb3b7

media/codec2/sfplugin/CCodecBuffers.cpp

+8 −0
Original line number Diff line number Diff line
@@ -700,6 +700,10 @@ bool FlexBuffersImpl::releaseSlot( 
    }

    std::shared_ptr<C2Buffer> result = mBuffers[index].compBuffer.lock();

    if (!result) {

        if (!c2buffer) {

            clientBuffer->clearC2BufferRefs();

            return true;

        }

        result = clientBuffer->asC2Buffer();

        clientBuffer->clearC2BufferRefs();

        mBuffers[index].compBuffer = result;
@@ -828,6 +832,10 @@ bool BuffersArrayImpl::returnBuffer( 
    ALOGV("[%s] %s: matching buffer found (index=%zu)", mName, __func__, index);

    std::shared_ptr<C2Buffer> result = mBuffers[index].compBuffer.lock();

    if (!result) {

        if (!c2buffer) {

            clientBuffer->clearC2BufferRefs();

            return true;

        }

        result = clientBuffer->asC2Buffer();

        clientBuffer->clearC2BufferRefs();

        mBuffers[index].compBuffer = result;