Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aca925da authored by Wei Jia's avatar Wei Jia Committed by android-build-merger
Browse files

SoftAMR: check output buffer size to avoid overflow. am: a3536c61 am: 1d8b35d7... 

SoftAMR: check output buffer size to avoid overflow. am: a3536c61 am: 1d8b35d7 am: 7837c492 am: 9e5c82b8 am: 84c5e675
am: baec8f68

* commit 'baec8f68':
  SoftAMR: check output buffer size to avoid overflow.
parents 788b0b65 baec8f68

media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp

+18 −0
Original line number Diff line number Diff line
@@ -332,6 +332,15 @@ void SoftAMR::onQueueFilled(OMX_U32 /* portIndex */) { 
        int32_t numBytesRead;



        if (mMode == MODE_NARROW) {

            if (outHeader->nAllocLen < kNumSamplesPerFrameNB * sizeof(int16_t)) {

                ALOGE("b/27662364: NB expected output buffer %zu bytes vs %u",

                       kNumSamplesPerFrameNB * sizeof(int16_t), outHeader->nAllocLen);

                android_errorWriteLog(0x534e4554, "27662364");

                notify(OMX_EventError, OMX_ErrorOverflow, 0, NULL);

                mSignalledError = true;

                return;

            }



            numBytesRead =

                AMRDecode(mState,

                  (Frame_Type_3GPP)((inputPtr[0] >> 3) & 0x0f),
@@ -359,6 +368,15 @@ void SoftAMR::onQueueFilled(OMX_U32 /* portIndex */) { 
                return;

            }

        } else {

            if (outHeader->nAllocLen < kNumSamplesPerFrameWB * sizeof(int16_t)) {

                ALOGE("b/27662364: WB expected output buffer %zu bytes vs %u",

                       kNumSamplesPerFrameWB * sizeof(int16_t), outHeader->nAllocLen);

                android_errorWriteLog(0x534e4554, "27662364");

                notify(OMX_EventError, OMX_ErrorOverflow, 0, NULL);

                mSignalledError = true;

                return;

            }



            int16 mode = ((inputPtr[0] >> 3) & 0x0f);



            if (mode >= 10 && mode <= 13) {