Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 85be0087 authored by Robert Shih's avatar Robert Shih Committed by android-build-merger
Browse files

Merge \\\\\"SoftVPX: fix nFilledLen overflow\\\\\" into mnc-dev am: ab495a88... 

Merge \\\\\"SoftVPX: fix nFilledLen overflow\\\\\" into mnc-dev am: ab495a88 am: 0fb0771c am: 6b4db071 am: 5eab23fe
am: cd7ba625

Change-Id: Id51f734f866ff8ed90ea342bf43ceec2d4153706
parents eee9f495 cd7ba625

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

+19 −3
Original line number Diff line number Diff line
@@ -156,7 +156,7 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por 
        outHeader->nFlags = 0;

        outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;

        outHeader->nTimeStamp = *(OMX_TICKS *)mImg->user_priv;

        if (outHeader->nAllocLen >= outHeader->nFilledLen) {

        if (outputBufferSafe(outHeader)) {

            uint8_t *dst = outHeader->pBuffer;

            const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];

            const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
@@ -166,8 +166,6 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por 
            size_t srcVStride = mImg->stride[VPX_PLANE_V];

            copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);

        } else {

            ALOGE("b/27597103, buffer too small");

            android_errorWriteLog(0x534e4554, "27597103");

            outHeader->nFilledLen = 0;

        }
@@ -197,6 +195,24 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por 
    return true;

}



bool SoftVPX::outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader) {

    uint32_t width = outputBufferWidth();

    uint32_t height = outputBufferHeight();

    uint64_t nFilledLen = width;

    nFilledLen *= height;

    if (nFilledLen > UINT32_MAX / 3) {

        ALOGE("b/29421675, nFilledLen overflow %llu w %u h %u", nFilledLen, width, height);

        android_errorWriteLog(0x534e4554, "29421675");

        return false;

    } else if (outHeader->nAllocLen < outHeader->nFilledLen) {

        ALOGE("b/27597103, buffer too small");

        android_errorWriteLog(0x534e4554, "27597103");

        return false;

    }



    return true;

}



void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) {

    if (mOutputPortSettingsChange != NONE || mEOSStatus == OUTPUT_FRAMES_FLUSHED) {

        return;

media/libstagefright/codecs/on2/dec/SoftVPX.h

+1 −0
Original line number Diff line number Diff line
@@ -66,6 +66,7 @@ private: 
    status_t initDecoder();

    status_t destroyDecoder();

    bool outputBuffers(bool flushDecoder, bool display, bool eos, bool *portWillReset);

    bool outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader);



    DISALLOW_EVIL_CONSTRUCTORS(SoftVPX);

};