Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c44b53b authored by Wei Jia's avatar Wei Jia Committed by android-build-merger
Browse files

libstagefright: check requested memory size before allocation for... 

libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder. am: 87f8cbb2 am: a022f6e7
am: 27affe9e

* commit '27affe9e':
  libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
parents fa81e4df 27affe9e

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

+9 −0
Original line number Diff line number Diff line
@@ -37,6 +37,10 @@ 


#include <inttypes.h>



#ifndef INT32_MAX

#define INT32_MAX   2147483647

#endif



namespace android {



template<class T>
@@ -137,6 +141,11 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { 
    if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) {

        // Color conversion is needed.

        free(mInputFrameData);

        mInputFrameData = NULL;

        if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) {

            ALOGE("b/25812794, Buffer size is too big.");

            return OMX_ErrorBadParameter;

        }

        mInputFrameData =

            (uint8_t *) malloc((mWidth * mHeight * 3 ) >> 1);

        CHECK(mInputFrameData != NULL);

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+9 −0
Original line number Diff line number Diff line
@@ -26,6 +26,10 @@ 
#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/MediaDefs.h>



#ifndef INT32_MAX

#define INT32_MAX   2147483647

#endif



namespace android {



template<class T>
@@ -315,6 +319,11 @@ status_t SoftVPXEncoder::initEncoder() { 


    if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) {

        free(mConversionBuffer);

        mConversionBuffer = NULL;

        if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) {

            ALOGE("b/25812794, Buffer size is too big.");

            return UNKNOWN_ERROR;

        }

        mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2);

        if (mConversionBuffer == NULL) {

            ALOGE("Allocating conversion buffer failed.");