Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b1e52981 authored by Wonsik Kim's avatar Wonsik Kim Committed by Jessica Wagantall
Browse files

DO NOT MERGE codecs: check OMX buffer size before use in (vorbis|opus)dec 

Bug: 27833616
Ticket: CYNGNOS-2707
Change-Id: I1ccdd16a00741da072527a6d13e87fd7c7fe8c54
parent 7b6bbfd8

media/libstagefright/codecs/opus/dec/SoftOpus.cpp

+6 −1
Original line number Diff line number Diff line
@@ -428,12 +428,17 @@ void SoftOpus::onQueueFilled(OMX_U32 portIndex) { 


        const uint8_t *data = inHeader->pBuffer + inHeader->nOffset;

        const uint32_t size = inHeader->nFilledLen;

        size_t frameSize = kMaxOpusOutputPacketSizeSamples;

        if (frameSize > outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels) {

            frameSize = outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels;

            android_errorWriteLog(0x534e4554, "27833616");

        }



        int numFrames = opus_multistream_decode(mDecoder,

                                                data,

                                                size,

                                                (int16_t *)outHeader->pBuffer,

                                                kMaxOpusOutputPacketSizeSamples,

                                                frameSize,

                                                0);

        if (numFrames < 0) {

            ALOGE("opus_multistream_decode returned %d", numFrames);

media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp

+12 −1
Original line number Diff line number Diff line
@@ -257,6 +257,12 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) { 


        const uint8_t *data = header->pBuffer + header->nOffset;

        size_t size = header->nFilledLen;

        if (size < 7) {

            ALOGE("Too small input buffer: %zu bytes", size);

            android_errorWriteLog(0x534e4554, "27833616");

            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);

            return;

        }



        ogg_buffer buf;

        ogg_reference ref;
@@ -362,9 +368,14 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) { 
            ALOGW("vorbis_dsp_synthesis returned %d", err);

#endif

        } else {

            size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;

            if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {

                numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);

                android_errorWriteLog(0x534e4554, "27833616");

            }

            numFrames = vorbis_dsp_pcmout(

                    mState, (int16_t *)outHeader->pBuffer,

                    kMaxNumSamplesPerBuffer);

                    (numSamplesPerBuffer / mVi->channels));



            if (numFrames < 0) {

                ALOGE("vorbis_dsp_pcmout returned %d", numFrames);