Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e1d7751 authored by Wei Jia's avatar Wei Jia Committed by android-build-merger
Browse files

DO NOT MERGE - libstagefright: check requested memory size before allocation... 

DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
am: 6afc659b

* commit '6afc659b':
  DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
parents 781cd4f3 6afc659b

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

+10 −1
Original line number Diff line number Diff line
@@ -33,6 +33,10 @@ 


#include "SoftMPEG4Encoder.h"



#ifndef INT32_MAX

#define INT32_MAX   2147483647

#endif



namespace android {



template<class T>
@@ -149,7 +153,12 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { 


    if (mVideoColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {

        // Color conversion is needed.

        CHECK(mInputFrameData == NULL);

        free(mInputFrameData);

        mInputFrameData = NULL;

        if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) {

            ALOGE("b/25812794, Buffer size is too big.");

            return OMX_ErrorBadParameter;

        }

        mInputFrameData =

            (uint8_t *) malloc((mVideoWidth * mVideoHeight * 3 ) >> 1);

        CHECK(mInputFrameData != NULL);

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+8 −0
Original line number Diff line number Diff line
@@ -25,6 +25,10 @@ 
#include <media/stagefright/foundation/ADebug.h>

#include <media/stagefright/MediaDefs.h>



#ifndef INT32_MAX

#define INT32_MAX   2147483647

#endif



namespace android {
@@ -300,6 +304,10 @@ status_t SoftVPXEncoder::initEncoder() { 


    if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar || mInputDataIsMeta) {

        if (mConversionBuffer == NULL) {

            if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) {

                ALOGE("b/25812794, Buffer size is too big.");

                return UNKNOWN_ERROR;

            }

            mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2);

            if (mConversionBuffer == NULL) {

                ALOGE("Allocating conversion buffer failed.");