DO NOT MERGE - SoftVPX: fix nFilledLen overflow (b7ba49c1) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

+19 −3

Original line number	Diff line number	Diff line
		@@ -147,7 +147,7 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) {
		outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;
		outHeader->nFlags = EOSseen ? OMX_BUFFERFLAG_EOS : 0;
		outHeader->nTimeStamp = inHeader->nTimeStamp;
		if (outHeader->nAllocLen >= outHeader->nFilledLen) {
		if (outputBufferSafe(outHeader)) {
		uint8_t *dst = outHeader->pBuffer;
		const uint8_t srcY = (const uint8_t )mImg->planes[VPX_PLANE_Y];
		const uint8_t srcU = (const uint8_t )mImg->planes[VPX_PLANE_U];
		@@ -157,8 +157,6 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) {
		size_t srcVStride = mImg->stride[VPX_PLANE_V];
		copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);
		} else {
		ALOGE("b/27597103, buffer too small");
		android_errorWriteLog(0x534e4554, "27597103");
		outHeader->nFilledLen = 0;
		}

		@@ -178,6 +176,24 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) {
		}
		}

		bool SoftVPX::outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader) {
		uint32_t width = outputBufferWidth();
		uint32_t height = outputBufferHeight();
		uint64_t nFilledLen = width;
		nFilledLen *= height;
		if (nFilledLen > UINT32_MAX / 3) {
		ALOGE("b/29421675, nFilledLen overflow %llu w %u h %u", nFilledLen, width, height);
		android_errorWriteLog(0x534e4554, "29421675");
		return false;
		} else if (outHeader->nAllocLen < outHeader->nFilledLen) {
		ALOGE("b/27597103, buffer too small");
		android_errorWriteLog(0x534e4554, "27597103");
		return false;
		}

		return true;
		}

		} // namespace android

		android::SoftOMXComponent *createSoftOMXComponent(

media/libstagefright/codecs/on2/dec/SoftVPX.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -54,6 +54,7 @@ private:
		vpx_image_t *mImg;

		status_t initDecoder();
		bool outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader);

		DISALLOW_EVIL_CONSTRUCTORS(SoftVPX);
		};