Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21bbc879 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Checking BadOffset while queuing buffers" into main am: 978ed252 am: 04464a07 

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/3042241



Change-Id: I9da7c70e6dd141f438871df72ec7d4d397d9faa9
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 18102891 04464a07

media/jni/android_media_MediaCodec.cpp

+7 −2
Original line number Original line Diff line number Diff line
@@ -2099,9 +2099,14 @@ static status_t extractInfosFromObject( 
        }

        }

        if (i == 0) {

        if (i == 0) {

            *initialOffset = offset;

            *initialOffset = offset;

            if (CC_UNLIKELY(*initialOffset < 0)) {

                if (errorDetailMsg) {

                    *errorDetailMsg = "Error: offset/size in BufferInfo";

                }

                return BAD_VALUE;

            }

        }

        }

        if (CC_UNLIKELY((offset >  UINT32_MAX)

        if (CC_UNLIKELY(((ssize_t)(UINT32_MAX - offset) < (ssize_t)size)

                || ((long)(offset + size) > UINT32_MAX)

                || ((offset - *initialOffset) != *totalSize))) {

                || ((offset - *initialOffset) != *totalSize))) {

            if (errorDetailMsg) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: offset/size in BufferInfo";

                *errorDetailMsg = "Error: offset/size in BufferInfo";