Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b06b9dfc authored by Wonsik Kim's avatar Wonsik Kim Committed by Android (Google) Code Review
Browse files

Merge "codecs: check OMX buffer size before use in (vorbis|opus)dec" into nyc-dev

parents 1645a537 e6a2b5d7

media/libstagefright/codecs/opus/dec/SoftOpus.cpp

+6 −1
Original line number Diff line number Diff line
@@ -458,12 +458,17 @@ void SoftOpus::onQueueFilled(OMX_U32 portIndex) { 


        const uint8_t *data = inHeader->pBuffer + inHeader->nOffset;

        const uint32_t size = inHeader->nFilledLen;

        size_t frameSize = kMaxOpusOutputPacketSizeSamples;

        if (frameSize > outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels) {

            frameSize = outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels;

            android_errorWriteLog(0x534e4554, "27887390");

        }



        int numFrames = opus_multistream_decode(mDecoder,

                                                data,

                                                size,

                                                (int16_t *)outHeader->pBuffer,

                                                kMaxOpusOutputPacketSizeSamples,

                                                frameSize,

                                                0);

        if (numFrames < 0) {

            ALOGE("opus_multistream_decode returned %d", numFrames);

media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp

+13 −1
Original line number Diff line number Diff line
@@ -274,6 +274,13 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) { 


        const uint8_t *data = header->pBuffer + header->nOffset;

        size_t size = header->nFilledLen;

        if (size < 7) {

            ALOGE("Too small input buffer: %zu bytes", size);

            android_errorWriteLog(0x534e4554, "27887390");

            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

            mSignalledError = true;

            return;

        }



        ogg_buffer buf;

        ogg_reference ref;
@@ -395,9 +402,14 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) { 
            ALOGW("vorbis_dsp_synthesis returned %d", err);

#endif

        } else {

            size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;

            if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {

                numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);

                android_errorWriteLog(0x534e4554, "27887390");

            }

            numFrames = vorbis_dsp_pcmout(

                    mState, (int16_t *)outHeader->pBuffer,

                    (kMaxNumSamplesPerBuffer / mVi->channels));

                    (numSamplesPerBuffer / mVi->channels));



            if (numFrames < 0) {

                ALOGE("vorbis_dsp_pcmout returned %d", numFrames);