Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d752f742 authored by Gopalakrishnan Nallasamy's avatar Gopalakrishnan Nallasamy Committed by Automerger Merge Worker
Browse files

Merge "SimpleDecodingSource:Prevent OOB write in heap mem" into sc-qpr1-dev am: 381c54bf 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/15940261

Change-Id: Ibf80c1d1df957f2d9cacb011b3ac60049ce20fe1
parents 3de17646 381c54bf

media/libstagefright/SimpleDecodingSource.cpp

+8 −3
Original line number Diff line number Diff line
@@ -325,11 +325,16 @@ status_t SimpleDecodingSource::doRead( 
                    if (!in_buf->meta_data().findInt32(kKeyValidSamples, &numPageSamples)) {

                        numPageSamples = -1;

                    }

                    if (cpLen + sizeof(numPageSamples) <= in_buffer->capacity()) {

                        memcpy(in_buffer->base() + cpLen, &numPageSamples, sizeof(numPageSamples));

                        cpLen += sizeof(numPageSamples);

                    } else {

                        ALOGW("Didn't have enough space to copy kKeyValidSamples");

                    }

                }



                res = mCodec->queueInputBuffer(

                        in_ix, 0 /* offset */, in_buf->range_length() + (mIsVorbis ? 4 : 0),

                        in_ix, 0 /* offset */, cpLen,

                        timestampUs, 0 /* flags */);

                if (res != OK) {

                    ALOGI("[%s] failed to queue input buffer #%zu", mComponentName.c_str(), in_ix);