Merge "DO NOT MERGE codecs: check OMX buffer size before use in (vorbis|opus)dec" into lmp-dev (7e217db1) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/opus/dec/SoftOpus.cpp

+6 −1

Original line number	Diff line number	Diff line
		@@ -428,12 +428,17 @@ void SoftOpus::onQueueFilled(OMX_U32 portIndex) {

		const uint8_t *data = inHeader->pBuffer + inHeader->nOffset;
		const uint32_t size = inHeader->nFilledLen;
		size_t frameSize = kMaxOpusOutputPacketSizeSamples;
		if (frameSize > outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels) {
		frameSize = outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels;
		android_errorWriteLog(0x534e4554, "27833616");
		}

		int numFrames = opus_multistream_decode(mDecoder,
		data,
		size,
		(int16_t *)outHeader->pBuffer,
		kMaxOpusOutputPacketSizeSamples,
		frameSize,
		0);
		if (numFrames < 0) {
		ALOGE("opus_multistream_decode returned %d", numFrames);

+12 −1

Original line number	Diff line number	Diff line
		@@ -273,6 +273,12 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {

		const uint8_t *data = header->pBuffer + header->nOffset;
		size_t size = header->nFilledLen;
		if (size < 7) {
		ALOGE("Too small input buffer: %zu bytes", size);
		android_errorWriteLog(0x534e4554, "27833616");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
		return;
		}

		ogg_buffer buf;
		ogg_reference ref;
		@@ -378,9 +384,14 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
		ALOGW("vorbis_dsp_synthesis returned %d", err);
		#endif
		} else {
		size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;
		if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {
		numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);
		android_errorWriteLog(0x534e4554, "27833616");
		}
		numFrames = vorbis_dsp_pcmout(
		mState, (int16_t *)outHeader->pBuffer,
		(kMaxNumSamplesPerBuffer / mVi->channels));
		(numSamplesPerBuffer / mVi->channels));

		if (numFrames < 0) {
		ALOGE("vorbis_dsp_pcmout returned %d", numFrames);