Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b240660c authored by Gopalakrishnan Nallasamy's avatar Gopalakrishnan Nallasamy Committed by Automerger Merge Worker
Browse files

SimpleDecodingSource:Prevent OOB write in heap mem am: f3590a1b 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/16187628

Change-Id: I7c23c9ca1ff4505f8dbeda68f81a054f8890f8a6
parents 1b210829 f3590a1b

media/libstagefright/SimpleDecodingSource.cpp

+8 −3
Original line number Diff line number Diff line
@@ -325,11 +325,16 @@ status_t SimpleDecodingSource::doRead( 
                    if (!in_buf->meta_data().findInt32(kKeyValidSamples, &numPageSamples)) {

                        numPageSamples = -1;

                    }

                    if (cpLen + sizeof(numPageSamples) <= in_buffer->capacity()) {

                        memcpy(in_buffer->base() + cpLen, &numPageSamples, sizeof(numPageSamples));

                        cpLen += sizeof(numPageSamples);

                    } else {

                        ALOGW("Didn't have enough space to copy kKeyValidSamples");

                    }

                }



                res = mCodec->queueInputBuffer(

                        in_ix, 0 /* offset */, in_buf->range_length() + (mIsVorbis ? 4 : 0),

                        in_ix, 0 /* offset */, cpLen,

                        timestampUs, 0 /* flags */);

                if (res != OK) {

                    ALOGI("[%s] failed to queue input buffer #%zu", mComponentName.c_str(), in_ix);