Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f24da9b authored by Marco Nelissen's avatar Marco Nelissen Committed by Automerger Merge Worker
Browse files

Fix memory overflow in ESQueue am: 91fed774 am: 979ebeac

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/12794733

Change-Id: I23d28a0cda7a0454b5443e586517af10b7774d74
parents abc29d84 979ebeac
Loading
Loading
Loading
Loading
+7 −1
Original line number Diff line number Diff line
@@ -1119,7 +1119,13 @@ sp<ABuffer> ElementaryStreamQueue::dequeueAccessUnitH264() {
                if (mSampleDecryptor != NULL && (nalType == 1 || nalType == 5)) {
                    uint8_t *nalData = mBuffer->data() + pos.nalOffset;
                    size_t newSize = mSampleDecryptor->processNal(nalData, pos.nalSize);
                    // Note: the data can shrink due to unescaping
                    // Note: the data can shrink due to unescaping, but it can never grow
                    if (newSize > pos.nalSize) {
                        // don't log unless verbose, since this can get called a lot if
                        // the caller is trying to resynchronize
                        ALOGV("expected sample size < %u, got %zu", pos.nalSize, newSize);
                        return NULL;
                    }
                    memcpy(accessUnit->data() + dstOffset + 4,
                            nalData,
                            newSize);