Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c19b4321 authored by Gopalakrishnan Nallasamy's avatar Gopalakrishnan Nallasamy Committed by Automerger Merge Worker
Browse files

SimpleDecodingSource:Prevent OOB write in heap mem am: f3590a1b am:... 

SimpleDecodingSource:Prevent OOB write in heap mem am: f3590a1b am: b240660c am: 247199f3 am: e3f218d6 am: 82ddf01e am: aa765964

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/16187628

Change-Id: I98357c2597b4f5d2ec11d5d69553045b55559461
parents 1171f685 aa765964

media/libstagefright/SimpleDecodingSource.cpp

+8 −3
Original line number Diff line number Diff line
@@ -325,11 +325,16 @@ status_t SimpleDecodingSource::doRead( 
                    if (!in_buf->meta_data().findInt32(kKeyValidSamples, &numPageSamples)) {

                        numPageSamples = -1;

                    }

                    if (cpLen + sizeof(numPageSamples) <= in_buffer->capacity()) {

                        memcpy(in_buffer->base() + cpLen, &numPageSamples, sizeof(numPageSamples));

                        cpLen += sizeof(numPageSamples);

                    } else {

                        ALOGW("Didn't have enough space to copy kKeyValidSamples");

                    }

                }



                res = mCodec->queueInputBuffer(

                        in_ix, 0 /* offset */, in_buf->range_length() + (mIsVorbis ? 4 : 0),

                        in_ix, 0 /* offset */, cpLen,

                        timestampUs, 0 /* flags */);

                if (res != OK) {

                    ALOGI("[%s] failed to queue input buffer #%zu", mComponentName.c_str(), in_ix);