Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad1ce71a authored by Wei Jia's avatar Wei Jia Committed by Android Git Automerger
Browse files

am 96a09849: am 50b600d6: am ab33de61: am 78df80c2: am 65842db0: Merge commit... 

am 96a09849: am 50b600d6: am ab33de61: am 78df80c2: am 65842db0: Merge commit \'b46eb8d9\' into HEAD

* commit '96a09849':
  SoftAVCEnc: check requested memory size before allocation.
parents 4a6807bb 96a09849

media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp

+8 −0
Original line number Diff line number Diff line
@@ -244,6 +244,10 @@ OMX_ERRORTYPE SoftAVCEncoder::initEncParams() { 
    if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) {

        // Color conversion is needed.

        free(mInputFrameData);

        if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) {

            ALOGE("Buffer size is too big.");

            return OMX_ErrorUndefined;

        }

        mInputFrameData =

            (uint8_t *) malloc((mWidth * mHeight * 3 ) >> 1);

        CHECK(mInputFrameData != NULL);
@@ -264,6 +268,10 @@ OMX_ERRORTYPE SoftAVCEncoder::initEncParams() { 


    int32_t nMacroBlocks = divUp(mWidth, 16) * divUp(mHeight, 16);

    CHECK(mSliceGroup == NULL);

    if (nMacroBlocks > SIZE_MAX / sizeof(uint32_t)) {

        ALOGE("requested memory size is too big.");

        return OMX_ErrorUndefined;

    }

    mSliceGroup = (uint32_t *) malloc(sizeof(uint32_t) * nMacroBlocks);

    CHECK(mSliceGroup != NULL);

    for (int ii = 0, idx = 0; ii < nMacroBlocks; ++ii) {