Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76dea1de authored by Wei Jia's avatar Wei Jia
Browse files

libstagefright: check overflow before memory allocation in OMXCodec.cpp 

Bug: 23416608
Change-Id: I4dacd38ed42db8f4887c3ee386dc909451f4346f
parent e857d28d

media/libstagefright/OMXCodec.cpp

+3 −0
Original line number Diff line number Diff line
@@ -1658,6 +1658,9 @@ status_t OMXCodec::allocateBuffersOnPort(OMX_U32 portIndex) { 
            def.nBufferCountActual, def.nBufferSize,

            portIndex == kPortIndexInput ? "input" : "output");



    if (def.nBufferSize != 0 && def.nBufferCountActual > SIZE_MAX / def.nBufferSize) {

        return BAD_VALUE;

    }

    size_t totalSize = def.nBufferCountActual * def.nBufferSize;

    mDealer[portIndex] = new MemoryDealer(totalSize, "OMXCodec");