Merge "OMXNodeInstance: Validate size of structures" into main (f6eb9450) · Commits · e / os / android_frameworks_av

media/libstagefright/omx/OMXNodeInstance.cpp

+38 −1

Original line number	Diff line number	Diff line
		@@ -102,6 +102,21 @@ static const OMX_U32 kPortIndexOutput = 1;

		namespace android {

		static bool isValidOmxParamSize(const void *params, OMX_U32 size) {
		// expect the vector to contain at least the size and version, two OMX_U32 entries.
		if (size < 2 * sizeof(OMX_U32)) {
		return false;
		}

		// expect the vector to be as large as the declared size
		OMX_U32 buf = (OMX_U32 )params;
		OMX_U32 declaredSize = (OMX_U32)buf;
		if (declaredSize > size) {
		return false;
		}
		return true;
		}

		struct BufferMeta {
		explicit BufferMeta(
		const sp<IMemory> &mem, const sp<IHidlMemory> &hidlMemory,
		@@ -688,6 +703,18 @@ bool OMXNodeInstance::isProhibitedIndex_l(OMX_INDEXTYPE index) {

		status_t OMXNodeInstance::getParameter(
		OMX_INDEXTYPE index, void *params, size_t size) {
		OMX_INDEXEXTTYPE extIndex = (OMX_INDEXEXTTYPE)index;
		if (extIndex == OMX_IndexParamConsumerUsageBits) {
		// expect the size to be 4 bytes for OMX_IndexParamConsumerUsageBits
		if (size != sizeof(OMX_U32)) {
		return BAD_VALUE;
		}
		} else {
		if (!isValidOmxParamSize(params, size)) {
		return BAD_VALUE;
		}
		}

		Mutex::Autolock autoLock(mLock);
		if (mHandle == NULL) {
		return DEAD_OBJECT;
		@@ -699,7 +726,6 @@ status_t OMXNodeInstance::getParameter(
		}

		OMX_ERRORTYPE err = OMX_GetParameter(mHandle, index, params);
		OMX_INDEXEXTTYPE extIndex = (OMX_INDEXEXTTYPE)index;
		// some errors are expected for getParameter
		if (err != OMX_ErrorNoMore) {
		CLOG_IF_ERROR(getParameter, err, "%s(%#x)", asString(extIndex), index);
		@@ -710,6 +736,10 @@ status_t OMXNodeInstance::getParameter(

		status_t OMXNodeInstance::setParameter(
		OMX_INDEXTYPE index, const void *params, size_t size) {
		if (!isValidOmxParamSize(params, size)) {
		return BAD_VALUE;
		}

		Mutex::Autolock autoLock(mLock);
		if (mHandle == NULL) {
		return DEAD_OBJECT;
		@@ -736,6 +766,9 @@ status_t OMXNodeInstance::setParameter(

		status_t OMXNodeInstance::getConfig(
		OMX_INDEXTYPE index, void *params, size_t size) {
		if (!isValidOmxParamSize(params, size)) {
		return BAD_VALUE;
		}
		Mutex::Autolock autoLock(mLock);
		if (mHandle == NULL) {
		return DEAD_OBJECT;
		@@ -759,6 +792,10 @@ status_t OMXNodeInstance::getConfig(

		status_t OMXNodeInstance::setConfig(
		OMX_INDEXTYPE index, const void *params, size_t size) {
		if (!isValidOmxParamSize(params, size)) {
		return BAD_VALUE;
		}

		Mutex::Autolock autoLock(mLock);
		if (mHandle == NULL) {
		return DEAD_OBJECT;