Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d79b7df authored by Ayushi Khopkar's avatar Ayushi Khopkar
Browse files

mpeg4_enc_fuzzer: Bug Fix 

Replaced stack allocation with heap allocation

Test: ./mpeg4_enc_fuzzer clusterfuzz-testcase-minimized-mpeg4_enc_fuzzer-5379218936561664
Bug: 172714629

Change-Id: I627c448d15a5de56a5a313bbeffb64c4dc5d1fae
parent 4275231c

media/libstagefright/codecs/m4v_h263/fuzzer/mpeg4_h263_enc_fuzzer.cpp

+4 −2
Original line number Diff line number Diff line
@@ -137,7 +137,8 @@ void Codec::deInitEncoder() { 
void Codec::encodeFrames(const uint8_t *data, size_t size) {

    size_t inputBufferSize = (mFrameWidth * mFrameHeight * 3) / 2;

    size_t outputBufferSize = inputBufferSize * 2;

    uint8_t outputBuffer[outputBufferSize];

    uint8_t *outputBuffer = new uint8_t[outputBufferSize];

    uint8_t *inputBuffer = new uint8_t[inputBufferSize];



    // Get VOL header.

    int32_t sizeOutputBuffer = outputBufferSize;
@@ -146,7 +147,6 @@ void Codec::encodeFrames(const uint8_t *data, size_t size) { 
    size_t numFrame = 0;

    while (size > 0) {

        size_t bytesConsumed = std::min(size, inputBufferSize);

        uint8_t inputBuffer[inputBufferSize];

        memcpy(inputBuffer, data, bytesConsumed);

        if (bytesConsumed < sizeof(inputBuffer)) {

            memset(inputBuffer + bytesConsumed, data[0], sizeof(inputBuffer) - bytesConsumed);
@@ -170,6 +170,8 @@ void Codec::encodeFrames(const uint8_t *data, size_t size) { 
        data += bytesConsumed;

        size -= bytesConsumed;

    }

    delete[] inputBuffer;

    delete[] outputBuffer;

}



extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {