Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77e1eb59 authored by Pawin Vongmasa's avatar Pawin Vongmasa
Browse files

RESTRICT AUTOMERGE Check the buffer index from acquireBuffer 

Test: Run the POC
Test: Small CtsMediaTestCases
Bug: 37563942
Change-Id: I8ddfbc91a08d96de1f732e6776d6f90997042f6b
parent 8bcf9aa2

media/libstagefright/omx/GraphicBufferSource.cpp

+18 −2
Original line number Diff line number Diff line
@@ -486,6 +486,12 @@ void GraphicBufferSource::suspend(bool suspend) { 
            } else if (err != OK) {

                ALOGW("suspend: acquireBuffer returned err=%d", err);

                break;

            } else if (item.mSlot < 0 ||

                    item.mSlot >= BufferQueue::NUM_BUFFER_SLOTS) {

                // Invalid buffer index

                ALOGW("suspend: corrupted buffer index (%d)",

                        item.mSlot);

                break;

            }



            ++mNumBufferAcquired;
@@ -607,6 +613,10 @@ bool GraphicBufferSource::fillCodecBuffer_l() { 
        // now what? fake end-of-stream?

        ALOGW("fillCodecBuffer_l: acquireBuffer returned err=%d", err);

        return false;

    } else if (item.mSlot < 0 || item.mSlot >= BufferQueue::NUM_BUFFER_SLOTS) {

        // Invalid buffer index

        ALOGW("fillCodecBuffer_l: corrupted buffer index (%d)", item.mSlot);

        return false;

    }



    mNumBufferAcquired++;
@@ -980,8 +990,14 @@ void GraphicBufferSource::onFrameAvailable(const BufferItem& /*item*/) { 
        BufferItem item;

        status_t err = mConsumer->acquireBuffer(&item, 0);

        if (err == OK) {

            if (item.mSlot < 0 ||

                    item.mSlot >= BufferQueue::NUM_BUFFER_SLOTS) {

                // Invalid buffer index

                ALOGW("onFrameAvailable: corrupted buffer index (%d)",

                        item.mSlot);

                return;

            }

            mNumBufferAcquired++;



            // If this is the first time we're seeing this buffer, add it to our

            // slot table.

            if (item.mGraphicBuffer != NULL) {