Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9b5a7ad0 authored by Wei Jia's avatar Wei Jia
Browse files

NuPlayerDecoder: check buffer size before memcpy 

Test: none
Bug: 111649621
Change-Id: I7f19a66a11eaeb54bf9513a4f56aa1ee7d3d81f5
parent 93adab13

media/libmediaplayer2/nuplayer2/NuPlayer2Decoder.cpp

+6 −0
Original line number Diff line number Diff line
@@ -1088,6 +1088,12 @@ bool NuPlayer2::Decoder::onInputBufferFetched(const sp<AMessage> &msg) { 
                        static_cast<MediaBufferHolder*>(holder.get())->mediaBuffer() : nullptr;

                }

                if (mediaBuf != NULL) {

                    if (mediaBuf->size() > codecBuffer->capacity()) {

                        handleError(ERROR_BUFFER_TOO_SMALL);

                        mDequeuedInputBuffers.push_back(bufferIx);

                        return false;

                    }



                    codecBuffer->setRange(0, mediaBuf->size());

                    memcpy(codecBuffer->data(), mediaBuf->data(), mediaBuf->size());

media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp

+6 −0
Original line number Diff line number Diff line
@@ -1069,6 +1069,12 @@ bool NuPlayer::Decoder::onInputBufferFetched(const sp<AMessage> &msg) { 
                        static_cast<MediaBufferHolder*>(holder.get())->mediaBuffer() : nullptr;

                }

                if (mediaBuf != NULL) {

                    if (mediaBuf->size() > codecBuffer->capacity()) {

                        handleError(ERROR_BUFFER_TOO_SMALL);

                        mDequeuedInputBuffers.push_back(bufferIx);

                        return false;

                    }



                    codecBuffer->setRange(0, mediaBuf->size());

                    memcpy(codecBuffer->data(), mediaBuf->data(), mediaBuf->size());