Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb385ac6 authored by Wei Jia's avatar Wei Jia Committed by Android Git Automerger
Browse files

am 571d9731: Merge commit \'c642d411\' into HEAD

* commit '571d9731':
  DO NOT MERGE - SoftwareRenderer: sanity check buffer size before copying data.
parents 41de4ba1 571d9731
Loading
Loading
Loading
Loading
+9 −1
Original line number Diff line number Diff line
@@ -181,7 +181,7 @@ void SoftwareRenderer::resetFormatIfChanged(const sp<AMessage> &format) {
}

void SoftwareRenderer::render(
        const void *data, size_t /*size*/, int64_t timestampNs,
        const void *data, size_t size, int64_t timestampNs,
        void* /*platformPrivate*/, const sp<AMessage>& format) {
    resetFormatIfChanged(format);

@@ -210,6 +210,9 @@ void SoftwareRenderer::render(
                buf->stride, buf->height,
                0, 0, mCropWidth - 1, mCropHeight - 1);
    } else if (mColorFormat == OMX_COLOR_FormatYUV420Planar) {
        if ((size_t)mWidth * mHeight * 3 / 2 > size) {
            goto skip_copying;
        }
        const uint8_t *src_y = (const uint8_t *)data;
        const uint8_t *src_u = (const uint8_t *)data + mWidth * mHeight;
        const uint8_t *src_v = src_u + (mWidth / 2 * mHeight / 2);
@@ -239,6 +242,10 @@ void SoftwareRenderer::render(
        }
    } else if (mColorFormat == OMX_TI_COLOR_FormatYUV420PackedSemiPlanar
            || mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) {
        if ((size_t)mWidth * mHeight * 3 / 2 > size) {
            goto skip_copying;
        }

        const uint8_t *src_y =
            (const uint8_t *)data;

@@ -275,6 +282,7 @@ void SoftwareRenderer::render(
        LOG_ALWAYS_FATAL("bad color format %#x", mColorFormat);
    }

skip_copying:
    CHECK_EQ(0, mapper.unlock(buf->handle));

    if ((err = native_window_set_buffers_timestamp(mNativeWindow.get(),