Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69512319 authored by Pawin Vongmasa's avatar Pawin Vongmasa
Browse files

SoftMPEG4: Check the buffer size before writing the reference frame. 

Also prevent overflow in SoftMPEG4 and division by zero in SoftMPEG4Encoder.

Bug: 30033990
Change-Id: I7701f5fc54c2670587d122330e5dc851f64ed3c2
parent ee58cd85

media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp

+20 −2
Original line number Diff line number Diff line
@@ -203,8 +203,17 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { 
            PortInfo *port = editPortInfo(1);

            OMX_BUFFERHEADERTYPE *outHeader = port->mBuffers.editItemAt(1).mHeader;



            OMX_U32 yFrameSize = sizeof(uint8) * mHandle->size;

            if ((outHeader->nAllocLen < yFrameSize) ||

                    (outHeader->nAllocLen - yFrameSize < yFrameSize / 2)) {

                ALOGE("Too small output buffer for reference frame: %zu bytes",

                        outHeader->nAllocLen);

                android_errorWriteLog(0x534e4554, "30033990");

                notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

                mSignalledError = true;

                return;

            }

            PVSetReferenceYUV(mHandle, outHeader->pBuffer);



            mFramesConfigured = true;

        }
@@ -222,7 +231,16 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { 
        int32_t bufferSize = inHeader->nFilledLen;

        int32_t tmp = bufferSize;



        OMX_U32 frameSize = (mWidth * mHeight * 3) / 2;

        OMX_U32 frameSize;

        OMX_U64 yFrameSize = (OMX_U64)mWidth * (OMX_U64)mHeight;

        if (yFrameSize > ((OMX_U64)UINT32_MAX / 3) * 2) {

            ALOGE("Frame size too large");

            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

            mSignalledError = true;

            return;

        }

        frameSize = (OMX_U32)(yFrameSize + (yFrameSize / 2));



        if (outHeader->nAllocLen < frameSize) {

            android_errorWriteLog(0x534e4554, "27833616");

            ALOGE("Insufficient output buffer size");

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

+4 −0
Original line number Diff line number Diff line
@@ -116,6 +116,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { 
        ALOGE("Failed to get default encoding parameters");

        return OMX_ErrorUndefined;

    }

    if (mFramerate == 0) {

        ALOGE("Framerate should not be 0");

        return OMX_ErrorUndefined;

    }

    mEncParams->encMode = mEncodeMode;

    mEncParams->encWidth[0] = mWidth;

    mEncParams->encHeight[0] = mHeight;