DO NOT MERGE - SoftMPEG4: Check the buffer size before writing the reference frame. (920b0f78) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp

+20 −2

Original line number	Diff line number	Diff line
		@@ -190,8 +190,17 @@ void SoftMPEG4::onQueueFilled(OMX_U32 portIndex) {
		PortInfo *port = editPortInfo(1);
		OMX_BUFFERHEADERTYPE *outHeader = port->mBuffers.editItemAt(1).mHeader;

		OMX_U32 yFrameSize = sizeof(uint8) * mHandle->size;
		if ((outHeader->nAllocLen < yFrameSize) \|\|
		(outHeader->nAllocLen - yFrameSize < yFrameSize / 2)) {
		ALOGE("Too small output buffer for reference frame: %zu bytes",
		outHeader->nAllocLen);
		android_errorWriteLog(0x534e4554, "30033990");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
		mSignalledError = true;
		return;
		}
		PVSetReferenceYUV(mHandle, outHeader->pBuffer);

		mFramesConfigured = true;
		}

		@@ -209,7 +218,16 @@ void SoftMPEG4::onQueueFilled(OMX_U32 portIndex) {
		int32_t bufferSize = inHeader->nFilledLen;
		int32_t tmp = bufferSize;

		OMX_U32 frameSize = (mWidth * mHeight * 3) / 2;
		OMX_U32 frameSize;
		OMX_U64 yFrameSize = (OMX_U64)mWidth * (OMX_U64)mHeight;
		if (yFrameSize > ((OMX_U64)UINT32_MAX / 3) * 2) {
		ALOGE("Frame size too large");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
		mSignalledError = true;
		return;
		}
		frameSize = (OMX_U32)(yFrameSize + (yFrameSize / 2));

		if (outHeader->nAllocLen < frameSize) {
		android_errorWriteLog(0x534e4554, "27833616");
		ALOGE("Insufficient output buffer size");

+4 −0

Original line number	Diff line number	Diff line
		@@ -129,6 +129,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() {
		ALOGE("Failed to get default encoding parameters");
		return OMX_ErrorUndefined;
		}
		if (mVideoFrameRate == 0) {
		ALOGE("Framerate should not be 0");
		return OMX_ErrorUndefined;
		}
		mEncParams->encMode = mEncodeMode;
		mEncParams->encWidth[0] = mVideoWidth;
		mEncParams->encHeight[0] = mVideoHeight;