Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dcda2ec2 authored by Ray Essick's avatar Ray Essick Committed by android-build-merger
Browse files

Merge "Fix TOCTOU problem in libstagefright_soft_aacenc" into klp-dev 

am: 2076915c

Change-Id: Ib9bc5c92218231acefda2800df84a8bffe2da92f
parents bbca2719 2076915c

media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp

+12 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


//#define LOG_NDEBUG 0

#define LOG_TAG "SoftAACEncoder2"

#include <log/log.h>

#include <utils/Log.h>



#include "SoftAACEncoder2.h"
@@ -48,6 +49,7 @@ SoftAACEncoder2::SoftAACEncoder2( 
      mSentCodecSpecificData(false),

      mInputSize(0),

      mInputFrame(NULL),

      mAllocatedFrameSize(0),

      mInputTimeUs(-1ll),

      mSawInputEOS(false),

      mSignalledError(false) {
@@ -450,6 +452,15 @@ void SoftAACEncoder2::onQueueFilled(OMX_U32 portIndex) { 


            if (mInputFrame == NULL) {

                mInputFrame = new int16_t[numBytesPerInputFrame / sizeof(int16_t)];

                mAllocatedFrameSize = numBytesPerInputFrame;

            } else if (mAllocatedFrameSize != numBytesPerInputFrame) {

                ALOGE("b/34621073: changed size from %d to %d",

                        (int)mAllocatedFrameSize, (int)numBytesPerInputFrame);

                android_errorWriteLog(0x534e4554,"34621073");

                delete mInputFrame;

                mInputFrame = new int16_t[numBytesPerInputFrame / sizeof(int16_t)];

                mAllocatedFrameSize = numBytesPerInputFrame;



            }



            if (mInputSize == 0) {
@@ -600,6 +611,7 @@ void SoftAACEncoder2::onReset() { 
    delete[] mInputFrame;

    mInputFrame = NULL;

    mInputSize = 0;

    mAllocatedFrameSize = 0;



    mSentCodecSpecificData = false;

    mInputTimeUs = -1ll;

media/libstagefright/codecs/aacenc/SoftAACEncoder2.h

+1 −0
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ private: 
    bool mSentCodecSpecificData;

    size_t mInputSize;

    int16_t *mInputFrame;

    size_t mAllocatedFrameSize;

    int64_t mInputTimeUs;



    bool mSawInputEOS;