Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7424ab8 authored by Dongwon Kang's avatar Dongwon Kang Committed by Andreas Blaesius
Browse files

Apply input buffer validation also to AVC and MPEG4 encoders 

Input buffer validation is existing only on VPX encoders. This patch
applies the checking also to the other sw video encoders.

Bug: 69065651 Bug: 27569635
Test: run poc with and without the patch.
Test: pass post submit media CTS tests after disabling hw encoders.

KK backport adapted from:
https://github.com/cm12-amami/android_frameworks_av/commit/c1bcf88d602470b4b5d628ea17bc3099bc43fd9e

Merged-In: I1358df64352577fd6d41cd4bfec18be37c98fe6f
Change-Id: I1358df64352577fd6d41cd4bfec18be37c98fe6f
(cherry picked from commit fed57366)
parent dbcf220b

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

+8 −0
Original line number Diff line number Diff line
@@ -710,6 +710,14 @@ void SoftMPEG4Encoder::onQueueFilled(OMX_U32 portIndex) { 


        buffer_handle_t srcBuffer; // for MetaDataMode only

        if (inHeader->nFilledLen > 0) {

            OMX_ERRORTYPE error = validateInputBuffer(inHeader, mVideoWidth, mVideoHeight);

            if (error != OMX_ErrorNone) {

                ALOGE("b/69065651");

                android_errorWriteLog(0x534e4554, "69065651");

                mSignalledError = true;

                notify(OMX_EventError, error, 0, 0);

                return;

            }

            uint8_t *inputData = NULL;

            if (mStoreMetaDataInBuffers) {

                if (inHeader->nFilledLen != 8) {

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

+7 −8
Original line number Diff line number Diff line
@@ -821,6 +821,13 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) { 
            return;

        }



        OMX_ERRORTYPE error = validateInputBuffer(inputBufferHeader, mWidth, mHeight);

        if (error != OMX_ErrorNone) {

            ALOGE("b/27569635");

            android_errorWriteLog(0x534e4554, "27569635");

            notify(OMX_EventError, error, 0, 0);

            return;

        }

        uint8_t *source =

            inputBufferHeader->pBuffer + inputBufferHeader->nOffset;
@@ -857,14 +864,6 @@ void SoftVPXEncoder::onQueueFilled(OMX_U32 portIndex) { 


            CHECK_EQ(0, grmodule->unlock(grmodule, handle));

        } else {

            if (inputBufferHeader->nFilledLen < frameSize) {

                android_errorWriteLog(0x534e4554, "27569635");

                notify(OMX_EventError, OMX_ErrorUndefined, 0, 0);

                return;

            } else if (inputBufferHeader->nFilledLen > frameSize) {

                ALOGW("Input buffer contains too many pixels");

            }



            if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {

                ConvertSemiPlanarToPlanar(

                        source, mConversionBuffer, mWidth, mHeight);

media/libstagefright/include/SimpleSoftOMXComponent.h

+4 −0
Original line number Diff line number Diff line
@@ -75,6 +75,10 @@ protected: 


    PortInfo *editPortInfo(OMX_U32 portIndex);



    OMX_ERRORTYPE validateInputBuffer(

                  const OMX_BUFFERHEADERTYPE *inputBufferHeader,

                  int32_t frameWidth, int32_t frameHeight);



private:

    enum {

        kWhatSendCommand,

media/libstagefright/omx/SimpleSoftOMXComponent.cpp

+12 −0
Original line number Diff line number Diff line
@@ -670,4 +670,16 @@ SimpleSoftOMXComponent::PortInfo *SimpleSoftOMXComponent::editPortInfo( 
    return &mPorts.editItemAt(portIndex);

}



OMX_ERRORTYPE SimpleSoftOMXComponent::validateInputBuffer(

        const OMX_BUFFERHEADERTYPE *inputBufferHeader,

        int32_t frameWidth, int32_t frameHeight) {

    size_t frameSize = frameWidth * frameHeight * 3 / 2;

    if (inputBufferHeader->nFilledLen < frameSize) {

        return OMX_ErrorUndefined;

    } else if (inputBufferHeader->nFilledLen > frameSize) {

        ALOGW("Input buffer contains more data than expected.");

    }

    return OMX_ErrorNone;

}



}  // namespace android