Merge \\\\\\"Revert \\\\\\"Impose a size bound for dynamically allocated... (a5ad0383) · Commits · e / os / android_frameworks_av

include/media/stagefright/DataSource.h

+5 −7

Original line number	Original line	Diff line number	Diff line
	@@ -27,7 +27,6 @@
	#include <utils/RefBase.h>		#include <utils/RefBase.h>
	#include <utils/threads.h>		#include <utils/threads.h>
	#include <drm/DrmManagerClient.h>		#include <drm/DrmManagerClient.h>
	#include <vector>

	namespace android {		namespace android {

	@@ -78,7 +77,7 @@ public:
	// The default value for chunkSize is set to read at least 4k bytes at a		// The default value for chunkSize is set to read at least 4k bytes at a
	// time, depending on sizeof(T).		// time, depending on sizeof(T).
	template <typename T>		template <typename T>
	bool getVector(off64_t offset, std::vector<T>* x, size_t count,		bool getVector(off64_t offset, Vector<T>* x, size_t count,
	size_t chunkSize = (4095 / sizeof(T)) + 1);		size_t chunkSize = (4095 / sizeof(T)) + 1);

	// May return ERROR_UNSUPPORTED.		// May return ERROR_UNSUPPORTED.
	@@ -132,7 +131,7 @@ private:
	};		};

	template <typename T>		template <typename T>
	bool DataSource::getVector(off64_t offset, std::vector<T>* x, size_t count,		bool DataSource::getVector(off64_t offset, Vector<T>* x, size_t count,
	size_t chunkSize)		size_t chunkSize)
	{		{
	x->clear();		x->clear();
	@@ -158,11 +157,10 @@ bool DataSource::getVector(off64_t offset, std::vector<T>* x, size_t count,
	if (numBytesRead < numBytesPerChunk) {		if (numBytesRead < numBytesPerChunk) {
	// This case is triggered when the stream ends before the whole		// This case is triggered when the stream ends before the whole
	// chunk is read.		// chunk is read.
	x->insert(x->end(), &tmp[0],		x->appendArray(tmp, (size_t)numBytesRead / sizeof(T));
	&tmp[(size_t)numBytesRead / sizeof(T)]);
	return false;		return false;
	}		}
	x->insert(x->end(), &tmp[0], &tmp[chunkSize]);		x->appendArray(tmp, chunkSize);
	offset += numBytesPerChunk;		offset += numBytesPerChunk;
	}		}

	@@ -173,7 +171,7 @@ bool DataSource::getVector(off64_t offset, std::vector<T>* x, size_t count,
	if (numBytesRead == -1) {		if (numBytesRead == -1) {
	return false;		return false;
	}		}
	x->insert(x->end(), &tmp[0], &tmp[(size_t)numBytesRead / sizeof(T)]);		x->appendArray(tmp, (size_t)numBytesRead / sizeof(T));
	return x->size() == count;		return x->size() == count;
	}		}

media/libstagefright/SampleTable.cpp

+12 −89

Original line number	Original line	Diff line number	Diff line
	@@ -132,8 +132,7 @@ SampleTable::SampleTable(const sp<DataSource> &source)
	mNumSyncSamples(0),		mNumSyncSamples(0),
	mSyncSamples(NULL),		mSyncSamples(NULL),
	mLastSyncSampleIndex(0),		mLastSyncSampleIndex(0),
	mSampleToChunkEntries(NULL),		mSampleToChunkEntries(NULL) {
	mTotalSize(0) {
	mSampleIterator = new SampleIterator(this);		mSampleIterator = new SampleIterator(this);
	}		}

	@@ -235,33 +234,11 @@ status_t SampleTable::setSampleToChunkParams(
	}		}

	if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets)		if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets)
	ALOGE("Sample-to-chunk table size too large.");
	return ERROR_OUT_OF_RANGE;		return ERROR_OUT_OF_RANGE;
	}

	mTotalSize += (size_t)mNumSampleToChunkOffsets *
	sizeof(SampleToChunkEntry);
	if (mTotalSize > kMaxTotalSize) {
	ALOGE("Sample-to-chunk table size would make sample table too large.\n"
	" Requested sample-to-chunk table size = %llu\n"
	" Eventual sample table size >= %llu\n"
	" Allowed sample table size = %llu\n",
	(unsigned long long)mNumSampleToChunkOffsets *
	sizeof(SampleToChunkEntry),
	(unsigned long long)mTotalSize,
	(unsigned long long)kMaxTotalSize);
	return ERROR_OUT_OF_RANGE;
	}

	mSampleToChunkEntries =		mSampleToChunkEntries =
	new SampleToChunkEntry[mNumSampleToChunkOffsets];		new SampleToChunkEntry[mNumSampleToChunkOffsets];

	if ((off64_t)(SIZE_MAX - 8 -
	((mNumSampleToChunkOffsets - 1) * sizeof(SampleToChunkEntry)))
	< mSampleToChunkOffset) {
	return ERROR_MALFORMED;
	}

	for (uint32_t i = 0; i < mNumSampleToChunkOffsets; ++i) {		for (uint32_t i = 0; i < mNumSampleToChunkOffsets; ++i) {
	uint8_t buffer[12];		uint8_t buffer[12];
	if (mDataSource->readAt(		if (mDataSource->readAt(
	@@ -371,33 +348,20 @@ status_t SampleTable::setTimeToSampleParams(
	// 2) mTimeToSampleCount is the number of entries of the time-to-sample		// 2) mTimeToSampleCount is the number of entries of the time-to-sample
	// table.		// table.
	// 3) We hope that the table size does not exceed UINT32_MAX.		// 3) We hope that the table size does not exceed UINT32_MAX.
	ALOGE("Time-to-sample table size too large.");		ALOGE(" Error: Time-to-sample table size too large.");
	return ERROR_OUT_OF_RANGE;		return ERROR_OUT_OF_RANGE;
	}		}

	// Note: At this point, we know that mTimeToSampleCount * 2 will not		// Note: At this point, we know that mTimeToSampleCount * 2 will not
	// overflow because of the above condition.		// overflow because of the above condition.

	mTotalSize += (uint64_t)mTimeToSampleCount * 2 * sizeof(uint32_t);
	if (mTotalSize > kMaxTotalSize) {
	ALOGE("Time-to-sample table size would make sample table too large.\n"
	" Requested time-to-sample table size = %llu\n"
	" Eventual sample table size >= %llu\n"
	" Allowed sample table size = %llu\n",
	(unsigned long long)mTimeToSampleCount * 2 * sizeof(uint32_t),
	(unsigned long long)mTotalSize,
	(unsigned long long)kMaxTotalSize);
	return ERROR_OUT_OF_RANGE;
	}

	if (!mDataSource->getVector(data_offset + 8, &mTimeToSample,		if (!mDataSource->getVector(data_offset + 8, &mTimeToSample,
	mTimeToSampleCount * 2)) {		mTimeToSampleCount * 2)) {
	ALOGE("Incomplete data read for time-to-sample table.");		ALOGE(" Error: Incomplete data read for time-to-sample table.");
	return ERROR_IO;		return ERROR_IO;
	}		}

	for (size_t i = 0; i < mTimeToSample.size(); ++i) {		for (size_t i = 0; i < mTimeToSample.size(); ++i) {
	mTimeToSample[i] = ntohl(mTimeToSample[i]);		mTimeToSample.editItemAt(i) = ntohl(mTimeToSample[i]);
	}		}

	mHasTimeToSample = true;		mHasTimeToSample = true;
	@@ -433,26 +397,14 @@ status_t SampleTable::setCompositionTimeToSampleParams(
	mNumCompositionTimeDeltaEntries = numEntries;		mNumCompositionTimeDeltaEntries = numEntries;
	uint64_t allocSize = (uint64_t)numEntries * 2 * sizeof(uint32_t);		uint64_t allocSize = (uint64_t)numEntries * 2 * sizeof(uint32_t);
	if (allocSize > SIZE_MAX) {		if (allocSize > SIZE_MAX) {
	ALOGE("Composition-time-to-sample table size too large.");
	return ERROR_OUT_OF_RANGE;
	}

	mTotalSize += allocSize;
	if (mTotalSize > kMaxTotalSize) {
	ALOGE("Composition-time-to-sample table would make sample table too large.\n"
	" Requested composition-time-to-sample table size = %llu\n"
	" Eventual sample table size >= %llu\n"
	" Allowed sample table size = %llu\n",
	(unsigned long long)allocSize,
	(unsigned long long)mTotalSize,
	(unsigned long long)kMaxTotalSize);
	return ERROR_OUT_OF_RANGE;		return ERROR_OUT_OF_RANGE;
	}		}

	mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries];		mCompositionTimeDeltaEntries = new uint32_t[2 * numEntries];

	if (mDataSource->readAt(data_offset + 8, mCompositionTimeDeltaEntries,		if (mDataSource->readAt(
	(size_t)allocSize) < (ssize_t)allocSize) {		data_offset + 8, mCompositionTimeDeltaEntries, numEntries * 8)
			< (ssize_t)numEntries * 8) {
	delete[] mCompositionTimeDeltaEntries;		delete[] mCompositionTimeDeltaEntries;
	mCompositionTimeDeltaEntries = NULL;		mCompositionTimeDeltaEntries = NULL;

	@@ -495,28 +447,13 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size)

	uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t);		uint64_t allocSize = mNumSyncSamples * (uint64_t)sizeof(uint32_t);
	if (allocSize > SIZE_MAX) {		if (allocSize > SIZE_MAX) {
	ALOGE("Sync sample table size too large.");
	return ERROR_OUT_OF_RANGE;
	}

	mTotalSize += allocSize;
	if (mTotalSize > kMaxTotalSize) {
	ALOGE("Sync sample table size would make sample table too large.\n"
	" Requested sync sample table size = %llu\n"
	" Eventual sample table size >= %llu\n"
	" Allowed sample table size = %llu\n",
	(unsigned long long)allocSize,
	(unsigned long long)mTotalSize,
	(unsigned long long)kMaxTotalSize);
	return ERROR_OUT_OF_RANGE;		return ERROR_OUT_OF_RANGE;
	}		}

	mSyncSamples = new (std::nothrow) uint32_t[mNumSyncSamples];		mSyncSamples = new uint32_t[mNumSyncSamples];
	if (!mSyncSamples)		size_t size = mNumSyncSamples * sizeof(uint32_t);
	return ERROR_OUT_OF_RANGE;		if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples, size)
			!= (ssize_t)size) {
	if (mDataSource->readAt(mSyncSampleOffset + 8, mSyncSamples,
	(size_t)allocSize) != (ssize_t)allocSize) {
	return ERROR_IO;		return ERROR_IO;
	}		}

	@@ -584,21 +521,7 @@ void SampleTable::buildSampleEntriesTable() {
	return;		return;
	}		}

	mTotalSize += (uint64_t)mNumSampleSizes * sizeof(SampleTimeEntry);		mSampleTimeEntries = new SampleTimeEntry[mNumSampleSizes];
	if (mTotalSize > kMaxTotalSize) {
	ALOGE("Sample entry table size would make sample table too large.\n"
	" Requested sample entry table size = %llu\n"
	" Eventual sample table size >= %llu\n"
	" Allowed sample table size = %llu\n",
	(unsigned long long)mNumSampleSizes * sizeof(SampleTimeEntry),
	(unsigned long long)mTotalSize,
	(unsigned long long)kMaxTotalSize);
	return;
	}

	mSampleTimeEntries = new (std::nothrow) SampleTimeEntry[mNumSampleSizes];
	if (!mSampleTimeEntries)
	return;

	uint32_t sampleIndex = 0;		uint32_t sampleIndex = 0;
	uint32_t sampleTime = 0;		uint32_t sampleTime = 0;

media/libstagefright/include/SampleTable.h

+2 −8

Original line number	Original line	Diff line number	Diff line
	@@ -24,7 +24,7 @@
	#include <media/stagefright/MediaErrors.h>		#include <media/stagefright/MediaErrors.h>
	#include <utils/RefBase.h>		#include <utils/RefBase.h>
	#include <utils/threads.h>		#include <utils/threads.h>
	#include <vector>		#include <utils/Vector.h>

	namespace android {		namespace android {

	@@ -96,9 +96,6 @@ private:
	static const uint32_t kSampleSizeType32;		static const uint32_t kSampleSizeType32;
	static const uint32_t kSampleSizeTypeCompact;		static const uint32_t kSampleSizeTypeCompact;

	// Limit the total size of all internal tables to 200MiB.
	static const size_t kMaxTotalSize = 200 * (1 << 20);

	sp<DataSource> mDataSource;		sp<DataSource> mDataSource;
	Mutex mLock;		Mutex mLock;

	@@ -116,7 +113,7 @@ private:

	bool mHasTimeToSample;		bool mHasTimeToSample;
	uint32_t mTimeToSampleCount;		uint32_t mTimeToSampleCount;
	std::vector<uint32_t> mTimeToSample;		Vector<uint32_t> mTimeToSample;

	struct SampleTimeEntry {		struct SampleTimeEntry {
	uint32_t mSampleIndex;		uint32_t mSampleIndex;
	@@ -142,9 +139,6 @@ private:
	};		};
	SampleToChunkEntry *mSampleToChunkEntries;		SampleToChunkEntry *mSampleToChunkEntries;

	// Approximate size of all tables combined.
	uint64_t mTotalSize;

	friend struct SampleIterator;		friend struct SampleIterator;

	// normally we don't round		// normally we don't round