Merge "NuPlayer2CCDecoder: Add bound check before memcpy" (f3a9f7d4) · Commits · e / os / android_frameworks_av

media/libmediaplayer2/nuplayer2/NuPlayer2CCDecoder.cpp

+18 −4

Original line number	Diff line number	Diff line
		@@ -372,10 +372,16 @@ bool NuPlayer2::CCDecoder::parseMPEGCCData(int64_t timeUs, const uint8_t *data,
		timeUs, mDTVCCPacket->data(), mDTVCCPacket->size());
		mDTVCCPacket->setRange(0, 0);
		}
		if (mDTVCCPacket->size() + 2 > mDTVCCPacket->capacity()) {
		return false;
		}
		memcpy(mDTVCCPacket->data() + mDTVCCPacket->size(), br.data(), 2);
		mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
		br.skipBits(16);
		} else if (mDTVCCPacket->size() > 0 && cc_type == 2) {
		if (mDTVCCPacket->size() + 2 > mDTVCCPacket->capacity()) {
		return false;
		}
		memcpy(mDTVCCPacket->data() + mDTVCCPacket->size(), br.data(), 2);
		mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
		br.skipBits(16);
		@@ -403,6 +409,9 @@ bool NuPlayer2::CCDecoder::parseMPEGCCData(int64_t timeUs, const uint8_t *data,
		line21CCBuf = new ABuffer((cc_count - i) * sizeof(CCData));
		line21CCBuf->setRange(0, 0);
		}
		if (line21CCBuf->size() + sizeof(cc) > line21CCBuf->capacity()) {
		return false;
		}
		memcpy(line21CCBuf->data() + line21CCBuf->size(), &cc, sizeof(cc));
		line21CCBuf->setRange(0, line21CCBuf->size() + sizeof(CCData));
		}
		@@ -464,6 +473,9 @@ bool NuPlayer2::CCDecoder::parseDTVCCPacket(int64_t timeUs, const uint8_t *data,
		size_t trackIndex = getTrackIndex(kTrackTypeCEA708, service_number, &trackAdded);
		if (mSelectedTrack == (ssize_t)trackIndex) {
		sp<ABuffer> ccPacket = new ABuffer(block_size);
		if (ccPacket->capacity() == 0) {
		return false;
		}
		memcpy(ccPacket->data(), br.data(), block_size);
		mCCMap.add(timeUs, ccPacket);
		}
		@@ -527,12 +539,14 @@ void NuPlayer2::CCDecoder::display(int64_t timeUs) {
		ccBuf = new ABuffer(size);
		ccBuf->setRange(0, 0);

		if (ccBuf->capacity() > 0) {
		for (ssize_t i = 0; i <= index; ++i) {
		sp<ABuffer> buf = mCCMap.valueAt(i);
		memcpy(ccBuf->data() + ccBuf->size(), buf->data(), buf->size());
		ccBuf->setRange(0, ccBuf->size() + buf->size());
		}
		}
		}

		if (ccBuf->size() > 0) {
		#if 0