Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c66f8ddd authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Add VPX output buffer size check 

and handle dead observers more gracefully

Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518
parent f5959b7b

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

+14 −9
Original line number Diff line number Diff line
@@ -147,7 +147,7 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) { 
            outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;

            outHeader->nFlags = EOSseen ? OMX_BUFFERFLAG_EOS : 0;

            outHeader->nTimeStamp = inHeader->nTimeStamp;



            if (outHeader->nAllocLen >= outHeader->nFilledLen) {

                uint8_t *dst = outHeader->pBuffer;

                const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];

                const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
@@ -156,6 +156,11 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) { 
                size_t srcUStride = mImg->stride[VPX_PLANE_U];

                size_t srcVStride = mImg->stride[VPX_PLANE_V];

                copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);

            } else {

                ALOGE("b/27597103, buffer too small");

                android_errorWriteLog(0x534e4554, "27597103");

                outHeader->nFilledLen = 0;

            }



            mImg = NULL;

            outInfo->mOwnedByUs = false;

media/libstagefright/omx/OMX.cpp

+6 −1
Original line number Diff line number Diff line
@@ -172,7 +172,12 @@ void OMX::binderDied(const wp<IBinder> &the_late_who) { 
        Mutex::Autolock autoLock(mLock);



        ssize_t index = mLiveNodes.indexOfKey(the_late_who);

        CHECK(index >= 0);



        if (index < 0) {

            ALOGE("b/27597103, nonexistent observer on binderDied");

            android_errorWriteLog(0x534e4554, "27597103");

            return;

        }



        instance = mLiveNodes.editValueAt(index);

        mLiveNodes.removeItemsAt(index);