Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f8282e3 authored by Arun Johnson's avatar Arun Johnson Committed by Automerger Merge Worker
Browse files

Merge "Correcting Offset and size checks while queing" into main am: 3376c751 am: 81227054 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/3052882



Change-Id: I98950057e25b71cf2313552a343fdc6c453f15b0
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 48556f26 81227054

media/jni/android_media_MediaCodec.cpp

+12 −16
Original line number Diff line number Diff line
@@ -2088,28 +2088,24 @@ static status_t extractInfosFromObject( 
            }

            return BAD_VALUE;

        }

        size_t offset = static_cast<size_t>(env->GetIntField(param, gFields.bufferInfoOffset));

        size_t size = static_cast<size_t>(env->GetIntField(param, gFields.bufferInfoSize));

        ssize_t offset = static_cast<ssize_t>(env->GetIntField(param, gFields.bufferInfoOffset));

        ssize_t size = static_cast<ssize_t>(env->GetIntField(param, gFields.bufferInfoSize));

        uint32_t flags = static_cast<uint32_t>(env->GetIntField(param, gFields.bufferInfoFlags));

        if (flags == 0 && size == 0) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: Queuing an empty BufferInfo";

            }

            return BAD_VALUE;

        }

        if (i == 0) {

            *initialOffset = offset;

            if (CC_UNLIKELY(*initialOffset < 0)) {

        }

        if (CC_UNLIKELY((offset < 0)

                || (size < 0)

                || ((INT32_MAX - offset) < size)

                || ((offset - (*initialOffset)) != *totalSize))) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: offset/size in BufferInfo";

            }

            return BAD_VALUE;

        }

        }

        if (CC_UNLIKELY(((ssize_t)(UINT32_MAX - offset) < (ssize_t)size)

                || ((offset - *initialOffset) != *totalSize))) {

        if (flags == 0 && size == 0) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: offset/size in BufferInfo";

                *errorDetailMsg = "Error: Queuing an empty BufferInfo";

            }

            return BAD_VALUE;

        }