Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3376c751 authored by Arun Johnson's avatar Arun Johnson Committed by Gerrit Code Review
Browse files

Merge "Correcting Offset and size checks while queing" into main

parents 2ad6d539 09b83103
Loading
Loading
Loading
Loading
+12 −16
Original line number Diff line number Diff line
@@ -2088,28 +2088,24 @@ static status_t extractInfosFromObject(
            }
            return BAD_VALUE;
        }
        size_t offset = static_cast<size_t>(env->GetIntField(param, gFields.bufferInfoOffset));
        size_t size = static_cast<size_t>(env->GetIntField(param, gFields.bufferInfoSize));
        ssize_t offset = static_cast<ssize_t>(env->GetIntField(param, gFields.bufferInfoOffset));
        ssize_t size = static_cast<ssize_t>(env->GetIntField(param, gFields.bufferInfoSize));
        uint32_t flags = static_cast<uint32_t>(env->GetIntField(param, gFields.bufferInfoFlags));
        if (flags == 0 && size == 0) {
            if (errorDetailMsg) {
                *errorDetailMsg = "Error: Queuing an empty BufferInfo";
            }
            return BAD_VALUE;
        }
        if (i == 0) {
            *initialOffset = offset;
            if (CC_UNLIKELY(*initialOffset < 0)) {
        }
        if (CC_UNLIKELY((offset < 0)
                || (size < 0)
                || ((INT32_MAX - offset) < size)
                || ((offset - (*initialOffset)) != *totalSize))) {
            if (errorDetailMsg) {
                *errorDetailMsg = "Error: offset/size in BufferInfo";
            }
            return BAD_VALUE;
        }
        }
        if (CC_UNLIKELY(((ssize_t)(UINT32_MAX - offset) < (ssize_t)size)
                || ((offset - *initialOffset) != *totalSize))) {
        if (flags == 0 && size == 0) {
            if (errorDetailMsg) {
                *errorDetailMsg = "Error: offset/size in BufferInfo";
                *errorDetailMsg = "Error: Queuing an empty BufferInfo";
            }
            return BAD_VALUE;
        }