Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f4a6c2b3 authored by Zach Riggle's avatar Zach Riggle
Browse files

OMX: Ensure nStride, if very negative, does not cause an overflow 

Per the definition of OMX_VIDEO_PORTDEFINITIONTYPE, nStride is a
signed value.

Test: make libstagefright
Change-Id: I189a5f90a61eacddd070fe25f5707e79f3cdac63
parent 4737a7ed

media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp

+2 −1
Original line number Diff line number Diff line
@@ -502,7 +502,8 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalSetParameter( 
            // These values were chosen to prevent integer overflows further down the line, and do

            // not indicate support for 32kx32k video.

            if (newWidth > 32768 || newHeight > 32768

                    || video_def->nStride > 32768 || video_def->nSliceHeight > 32768) {

                    || video_def->nStride > 32768 || video_def->nStride < -32768

                    || video_def->nSliceHeight > 32768) {

                ALOGE("b/22885421");

                return OMX_ErrorBadParameter;

            }