Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 792a4327 authored by Pawin Vongmasa's avatar Pawin Vongmasa Committed by android-build-merger
Browse files

SoftMPEG4: Check the buffer size before writing the reference frame. am:... 

SoftMPEG4: Check the buffer size before writing the reference frame. am: 69512319 am: af39271e am: 3efed2f1
am: 1cfd97c3

Change-Id: I9648977377ee7a06dff6ff00a4c74e31a0f44a3a
parents 5e523ead 1cfd97c3

media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp

+20 −2
Original line number Diff line number Diff line
@@ -210,8 +210,17 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { 
            PortInfo *port = editPortInfo(1);

            OMX_BUFFERHEADERTYPE *outHeader = port->mBuffers.editItemAt(1).mHeader;



            OMX_U32 yFrameSize = sizeof(uint8) * mHandle->size;

            if ((outHeader->nAllocLen < yFrameSize) ||

                    (outHeader->nAllocLen - yFrameSize < yFrameSize / 2)) {

                ALOGE("Too small output buffer for reference frame: %zu bytes",

                        outHeader->nAllocLen);

                android_errorWriteLog(0x534e4554, "30033990");

                notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

                mSignalledError = true;

                return;

            }

            PVSetReferenceYUV(mHandle, outHeader->pBuffer);



            mFramesConfigured = true;

        }
@@ -229,7 +238,16 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { 
        int32_t bufferSize = inHeader->nFilledLen;

        int32_t tmp = bufferSize;



        OMX_U32 frameSize = (mWidth * mHeight * 3) / 2;

        OMX_U32 frameSize;

        OMX_U64 yFrameSize = (OMX_U64)mWidth * (OMX_U64)mHeight;

        if (yFrameSize > ((OMX_U64)UINT32_MAX / 3) * 2) {

            ALOGE("Frame size too large");

            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

            mSignalledError = true;

            return;

        }

        frameSize = (OMX_U32)(yFrameSize + (yFrameSize / 2));



        if (outHeader->nAllocLen < frameSize) {

            android_errorWriteLog(0x534e4554, "27833616");

            ALOGE("Insufficient output buffer size");

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

+4 −0
Original line number Diff line number Diff line
@@ -116,6 +116,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { 
        ALOGE("Failed to get default encoding parameters");

        return OMX_ErrorUndefined;

    }

    if (mFramerate == 0) {

        ALOGE("Framerate should not be 0");

        return OMX_ErrorUndefined;

    }

    mEncParams->encMode = mEncodeMode;

    mEncParams->encWidth[0] = mWidth;

    mEncParams->encHeight[0] = mHeight;