Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 943fc122 authored by Ray Essick's avatar Ray Essick
Browse files

Fix NuMediaExtractor::readSampleData buffer Handling 

readSampleData() did not initialize buffer before filling it,
leading to OOB memory references. Correct and clarify the book
keeping around output buffer management.

Bug: 275418191
Test: CtsMediaExtractorTestCases w/debug messages
Change-Id: Ie744f118526f100d82a312c64f7c6fcf20773b6d
parent 943db3f3

media/libstagefright/NuMediaExtractor.cpp

+9 −5
Original line number Diff line number Diff line
@@ -639,9 +639,11 @@ status_t NuMediaExtractor::appendVorbisNumPageSamples( 
        numPageSamples = -1;

    }



    // insert, including accounting for the space used.

    memcpy((uint8_t *)buffer->data() + mbuf->range_length(),

           &numPageSamples,

           sizeof(numPageSamples));

    buffer->setRange(buffer->offset(), buffer->size() + sizeof(numPageSamples));



    uint32_t type;

    const void *data;
@@ -690,6 +692,8 @@ status_t NuMediaExtractor::readSampleData(const sp<ABuffer> &buffer) { 


    ssize_t minIndex = fetchAllTrackSamples();



    buffer->setRange(0, 0);     // start with an empty buffer



    if (minIndex < 0) {

        return ERROR_END_OF_STREAM;

    }
@@ -705,25 +709,25 @@ status_t NuMediaExtractor::readSampleData(const sp<ABuffer> &buffer) { 
        sampleSize += sizeof(int32_t);

    }



    // capacity() is ok since we cleared out the buffer

    if (buffer->capacity() < sampleSize) {

        return -ENOMEM;

    }



    const size_t srclen = it->mBuffer->range_length();

    const uint8_t *src =

        (const uint8_t *)it->mBuffer->data()

            + it->mBuffer->range_offset();



    memcpy((uint8_t *)buffer->data(), src, it->mBuffer->range_length());

    memcpy((uint8_t *)buffer->data(), src, srclen);

    buffer->setRange(0, srclen);



    status_t err = OK;

    if (info->mTrackFlags & kIsVorbis) {

        // adjusts range when it inserts the extra bits

        err = appendVorbisNumPageSamples(it->mBuffer, buffer);

    }



    if (err == OK) {

        buffer->setRange(0, sampleSize);

    }



    return err;

}