Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa24d3f2 authored by Marco Nelissen's avatar Marco Nelissen Committed by Jessica Wagantall
Browse files

Fix OMX_IndexParamConsumerUsageBits size check 

Ticket: CYNGNOS-2707
Bug: 27207275
Change-Id: I9a7c9fb22a0e84a490ff09c151bd2f88141fdbc0
parent 1a896b12

media/libmedia/IOMX.cpp

+4 −3
Original line number Original line Diff line number Diff line
@@ -701,11 +701,12 @@ status_t BnOMX::onTransact( 
            void *params = NULL;

            void *params = NULL;

            size_t pageSize = 0;

            size_t pageSize = 0;

            size_t allocSize = 0;

            size_t allocSize = 0;

            if ((index == (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits && size < 4) ||

            bool isUsageBits = (index == (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits);

                    (code != SET_INTERNAL_OPTION && size < 8)) {

            if ((isUsageBits && size < 4) ||

                    (!isUsageBits && code != SET_INTERNAL_OPTION && size < 8)) {

                // we expect the structure to contain at least the size and

                // we expect the structure to contain at least the size and

                // version, 8 bytes total

                // version, 8 bytes total

                ALOGE("b/27207275 (%zu)", size);

                ALOGE("b/27207275 (%zu) (%d/%d)", size, int(index), int(code));

                android_errorWriteLog(0x534e4554, "27207275");

                android_errorWriteLog(0x534e4554, "27207275");

            } else {

            } else {

                err = NO_MEMORY;

                err = NO_MEMORY;