Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81c5ab55 authored by Marco Nelissen's avatar Marco Nelissen Committed by Jessica Wagantall
Browse files

Add VPX output buffer size check 

and handle dead observers more gracefully

Ticket: CYNGNOS-2373
Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518
(cherry picked from commit c66f8ddd)
parent f631183a

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

+14 −9
Original line number Diff line number Diff line
@@ -150,7 +150,7 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) { 
            outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;

            outHeader->nFlags = EOSseen ? OMX_BUFFERFLAG_EOS : 0;

            outHeader->nTimeStamp = inHeader->nTimeStamp;



            if (outHeader->nAllocLen >= outHeader->nFilledLen) {

                uint8_t *dst = outHeader->pBuffer;

                const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];

                const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
@@ -159,6 +159,11 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) { 
                size_t srcUStride = mImg->stride[VPX_PLANE_U];

                size_t srcVStride = mImg->stride[VPX_PLANE_V];

                copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);

            } else {

                ALOGE("b/27597103, buffer too small");

                android_errorWriteLog(0x534e4554, "27597103");

                outHeader->nFilledLen = 0;

            }



            mImg = NULL;

            outInfo->mOwnedByUs = false;

media/libstagefright/omx/OMX.cpp

+6 −1
Original line number Diff line number Diff line
@@ -172,7 +172,12 @@ void OMX::binderDied(const wp<IBinder> &the_late_who) { 
        Mutex::Autolock autoLock(mLock);



        ssize_t index = mLiveNodes.indexOfKey(the_late_who);

        CHECK(index >= 0);



        if (index < 0) {

            ALOGE("b/27597103, nonexistent observer on binderDied");

            android_errorWriteLog(0x534e4554, "27597103");

            return;

        }



        instance = mLiveNodes.editValueAt(index);

        mLiveNodes.removeItemsAt(index);