Merge "codecs: check OMX buffer size before use in VP8 encoder." into lmp-dev... (b8b11e9e) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+22 −6

Original line number	Diff line number	Diff line
		@@ -729,9 +729,10 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 /* portIndex */) {
		const uint8_t *source =
		inputBufferHeader->pBuffer + inputBufferHeader->nOffset;

		size_t frameSize = mWidth * mHeight * 3 / 2;
		if (mInputDataIsMeta) {
		source = extractGraphicBuffer(
		mConversionBuffer, mWidth * mHeight * 3 / 2,
		mConversionBuffer, frameSize,
		source, inputBufferHeader->nFilledLen,
		mWidth, mHeight);
		if (source == NULL) {
		@@ -739,12 +740,22 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 /* portIndex */) {
		notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);
		return;
		}
		} else if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {
		} else {
		if (inputBufferHeader->nFilledLen < frameSize) {
		android_errorWriteLog(0x534e4554, "27569635");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);
		return;
		} else if (inputBufferHeader->nFilledLen > frameSize) {
		ALOGW("Input buffer contains too many pixels");
		}

		if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {
		ConvertYUV420SemiPlanarToYUV420Planar(
		source, mConversionBuffer, mWidth, mHeight);

		source = mConversionBuffer;
		}
		}
		vpx_image_t raw_frame;
		vpx_img_wrap(&raw_frame, VPX_IMG_FMT_I420, mWidth, mHeight,
		kInputBufferAlignment, (uint8_t *)source);
		@@ -808,6 +819,11 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 /* portIndex */) {
		outputBufferHeader->nFlags \|= OMX_BUFFERFLAG_SYNCFRAME;
		outputBufferHeader->nOffset = 0;
		outputBufferHeader->nFilledLen = encoded_packet->data.frame.sz;
		if (outputBufferHeader->nFilledLen > outputBufferHeader->nAllocLen) {
		android_errorWriteLog(0x534e4554, "27569635");
		notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);
		return;
		}
		memcpy(outputBufferHeader->pBuffer,
		encoded_packet->data.frame.buf,
		encoded_packet->data.frame.sz);