Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a573cea0 authored by Wonsik Kim's avatar Wonsik Kim Committed by android-build-merger
Browse files

Merge "DO NOT MERGE codecs: check OMX buffer size before use in VP8 encoder." into klp-dev 

am: 4f998235

* commit '4f998235':
  DO NOT MERGE codecs: check OMX buffer size before use in VP8 encoder.
parents 6ee73dab 4f998235

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+21 −5
Original line number Original line Diff line number Diff line
@@ -824,6 +824,7 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) { 
        uint8_t *source =

        uint8_t *source =

            inputBufferHeader->pBuffer + inputBufferHeader->nOffset;

            inputBufferHeader->pBuffer + inputBufferHeader->nOffset;





        size_t frameSize = mWidth * mHeight * 3 / 2;

        if (mInputDataIsMeta) {

        if (mInputDataIsMeta) {

            CHECK_GE(inputBufferHeader->nFilledLen,

            CHECK_GE(inputBufferHeader->nFilledLen,

                     4 + sizeof(buffer_handle_t));

                     4 + sizeof(buffer_handle_t));
@@ -855,12 +856,22 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) { 
            source = mConversionBuffer;

            source = mConversionBuffer;





            CHECK_EQ(0, grmodule->unlock(grmodule, handle));

            CHECK_EQ(0, grmodule->unlock(grmodule, handle));

        } else if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {

        } else {

            if (inputBufferHeader->nFilledLen < frameSize) {

                android_errorWriteLog(0x534e4554, "27569635");

                notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);

                return;

            } else if (inputBufferHeader->nFilledLen > frameSize) {

                ALOGW("Input buffer contains too many pixels");

            }



            if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {

                ConvertSemiPlanarToPlanar(

                ConvertSemiPlanarToPlanar(

                        source, mConversionBuffer, mWidth, mHeight);

                        source, mConversionBuffer, mWidth, mHeight);





                source = mConversionBuffer;

                source = mConversionBuffer;

            }

            }

        }

        vpx_image_t raw_frame;

        vpx_image_t raw_frame;

        vpx_img_wrap(&raw_frame, VPX_IMG_FMT_I420, mWidth, mHeight,

        vpx_img_wrap(&raw_frame, VPX_IMG_FMT_I420, mWidth, mHeight,

                     kInputBufferAlignment, source);

                     kInputBufferAlignment, source);
@@ -914,6 +925,11 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) { 
                    outputBufferHeader->nFlags |= OMX_BUFFERFLAG_SYNCFRAME;

                    outputBufferHeader->nFlags |= OMX_BUFFERFLAG_SYNCFRAME;

                outputBufferHeader->nOffset = 0;

                outputBufferHeader->nOffset = 0;

                outputBufferHeader->nFilledLen = encoded_packet->data.frame.sz;

                outputBufferHeader->nFilledLen = encoded_packet->data.frame.sz;

                if (outputBufferHeader->nFilledLen > outputBufferHeader->nAllocLen) {

                    android_errorWriteLog(0x534e4554, "27569635");

                    notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);

                    return;

                }

                memcpy(outputBufferHeader->pBuffer,

                memcpy(outputBufferHeader->pBuffer,

                       encoded_packet->data.frame.buf,

                       encoded_packet->data.frame.buf,

                       encoded_packet->data.frame.sz);

                       encoded_packet->data.frame.sz);