Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb949552 authored by Marco Nelissen's avatar Marco Nelissen Committed by Jessica Wagantall
Browse files

Add VPX output buffer size check 

and handle dead observers more gracefully

Ticket: CYNGNOS-2373
Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518
(cherry picked from commit ca00182c)
parent 31116f28

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

+14 −9
Original line number Diff line number Diff line
@@ -148,7 +148,7 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por 
        outHeader->nFlags = 0;

        outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;

        outHeader->nTimeStamp = *(OMX_TICKS *)mImg->user_priv;



        if (outHeader->nAllocLen >= outHeader->nFilledLen) {

            uint8_t *dst = outHeader->pBuffer;

            const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];

            const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
@@ -157,6 +157,11 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por 
            size_t srcUStride = mImg->stride[VPX_PLANE_U];

            size_t srcVStride = mImg->stride[VPX_PLANE_V];

            copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);

        } else {

            ALOGE("b/27597103, buffer too small");

            android_errorWriteLog(0x534e4554, "27597103");

            outHeader->nFilledLen = 0;

        }



        mImg = NULL;

        outInfo->mOwnedByUs = false;

media/libstagefright/omx/OMX.cpp

+6 −1
Original line number Diff line number Diff line
@@ -179,7 +179,12 @@ void OMX::binderDied(const wp<IBinder> &the_late_who) { 
        Mutex::Autolock autoLock(mLock);



        ssize_t index = mLiveNodes.indexOfKey(the_late_who);

        CHECK(index >= 0);



        if (index < 0) {

            ALOGE("b/27597103, nonexistent observer on binderDied");

            android_errorWriteLog(0x534e4554, "27597103");

            return;

        }



        instance = mLiveNodes.editValueAt(index);

        mLiveNodes.removeItemsAt(index);