Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09b83103 authored by Arun Johnson's avatar Arun Johnson
Browse files

Correcting Offset and size checks while queing 

Bug: 336058761
Bug: 333622829
Bug: 336058293
Test: android.mediav2.cts.CodecEncoderBlockModelMultiAccessUnitTest#testSimpleEncode
Test: android.mediav2.cts.CodecUnitTest$TestApi#testQueueInputBuffersInUnInitState

Change-Id: I4ce7fd2872ce3b4734050b68e5bf2c9b0519c898
parent 34542532

media/jni/android_media_MediaCodec.cpp

+12 −16
Original line number Diff line number Diff line
@@ -2088,28 +2088,24 @@ static status_t extractInfosFromObject( 
            }

            return BAD_VALUE;

        }

        size_t offset = static_cast<size_t>(env->GetIntField(param, gFields.bufferInfoOffset));

        size_t size = static_cast<size_t>(env->GetIntField(param, gFields.bufferInfoSize));

        ssize_t offset = static_cast<ssize_t>(env->GetIntField(param, gFields.bufferInfoOffset));

        ssize_t size = static_cast<ssize_t>(env->GetIntField(param, gFields.bufferInfoSize));

        uint32_t flags = static_cast<uint32_t>(env->GetIntField(param, gFields.bufferInfoFlags));

        if (flags == 0 && size == 0) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: Queuing an empty BufferInfo";

            }

            return BAD_VALUE;

        }

        if (i == 0) {

            *initialOffset = offset;

            if (CC_UNLIKELY(*initialOffset < 0)) {

        }

        if (CC_UNLIKELY((offset < 0)

                || (size < 0)

                || ((INT32_MAX - offset) < size)

                || ((offset - (*initialOffset)) != *totalSize))) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: offset/size in BufferInfo";

            }

            return BAD_VALUE;

        }

        }

        if (CC_UNLIKELY(((ssize_t)(UINT32_MAX - offset) < (ssize_t)size)

                || ((offset - *initialOffset) != *totalSize))) {

        if (flags == 0 && size == 0) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: offset/size in BufferInfo";

                *errorDetailMsg = "Error: Queuing an empty BufferInfo";

            }

            return BAD_VALUE;

        }