Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e4795c8 authored by James Dong's avatar James Dong
Browse files

Fix a memory corruption problem in software M4v/H263 decoder due to out-of-scope local variable

parent 05de7c88

media/libstagefright/OMXCodec.cpp

+2 −2
Original line number Diff line number Diff line
@@ -123,11 +123,11 @@ static const CodecInfo kDecoderInfo[] = { 
    { MEDIA_MIMETYPE_AUDIO_AAC, "OMX.PV.aacdec" },

    { MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.qcom.video.decoder.mpeg4" },

    { MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.TI.Video.Decoder" },

    OPTIONAL(MEDIA_MIMETYPE_VIDEO_MPEG4, "M4vH264Decoder")

    OPTIONAL(MEDIA_MIMETYPE_VIDEO_MPEG4, "M4vH263Decoder")

    { MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.PV.mpeg4dec" },

    { MEDIA_MIMETYPE_VIDEO_H263, "OMX.qcom.video.decoder.h263" },

    { MEDIA_MIMETYPE_VIDEO_H263, "OMX.TI.Video.Decoder" },

    OPTIONAL(MEDIA_MIMETYPE_VIDEO_H263, "M4vH264Decoder")

    OPTIONAL(MEDIA_MIMETYPE_VIDEO_H263, "M4vH263Decoder")

    { MEDIA_MIMETYPE_VIDEO_H263, "OMX.PV.h263dec" },

    { MEDIA_MIMETYPE_VIDEO_AVC, "OMX.qcom.video.decoder.avc" },

    { MEDIA_MIMETYPE_VIDEO_AVC, "OMX.TI.Video.Decoder" },

media/libstagefright/codecs/m4v_h263/dec/M4vH263Decoder.cpp

+11 −7
Original line number Diff line number Diff line
@@ -13,8 +13,9 @@ 
 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#define LOG_NDEBUG 0

//#define LOG_NDEBUG 0

#define LOG_TAG "M4vH263Decoder"

#include <utils/Log.h>



#include "ESDS.h"

#include "M4vH263Decoder.h"
@@ -37,8 +38,9 @@ M4vH263Decoder::M4vH263Decoder(const sp<MediaSource> &source) 
      mHandle(new tagvideoDecControls),

      mInputBuffer(NULL),

      mNumSamplesOutput(0) {

    memset(mHandle, 0, sizeof(tagvideoDecControls));



    LOGV("M4vH263Decoder");

    memset(mHandle, 0, sizeof(tagvideoDecControls));

    mFormat = new MetaData;

    mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_RAW);

    CHECK(mSource->getFormat()->findInt32(kKeyWidth, &mWidth));
@@ -47,7 +49,6 @@ M4vH263Decoder::M4vH263Decoder(const sp<MediaSource> &source) 
    mFormat->setInt32(kKeyHeight, mHeight);

    mFormat->setInt32(kKeyColorFormat, OMX_COLOR_FormatYUV420Planar);

    mFormat->setCString(kKeyDecoderComponent, "M4vH263Decoder");



}



M4vH263Decoder::~M4vH263Decoder() {
@@ -76,7 +77,7 @@ status_t M4vH263Decoder::start(MetaData *) { 
    uint32_t type;

    const void *data = NULL;

    size_t size = 0;

    uint8_t *vol_data = NULL;

    uint8_t *vol_data[1] = {0};

    int32_t vol_size = 0;

    if (mSource->getFormat()->findData(kKeyESDS, &type, &data, &size)) {

        ESDS esds((const uint8_t *)data, size);
@@ -86,14 +87,17 @@ status_t M4vH263Decoder::start(MetaData *) { 
        size_t codec_specific_data_size;

        esds.getCodecSpecificInfo(&codec_specific_data, &codec_specific_data_size);



        vol_data = (uint8_t *) codec_specific_data;

        vol_data[0] = (uint8_t *) malloc(codec_specific_data_size);

        memcpy(vol_data[0], codec_specific_data, codec_specific_data_size);

        vol_size = codec_specific_data_size;

    } else {

        vol_data = NULL;

        vol_data[0] = NULL;

        vol_size = 0;



    }

    CHECK_EQ(PV_TRUE, PVInitVideoDecoder(

            mHandle, &vol_data, &vol_size, 1, mWidth, mHeight, mode));

            mHandle, vol_data, &vol_size, 1, mWidth, mHeight, mode));

    if (vol_data[0]) free(vol_data[0]);

    MP4DecodingMode actualMode = PVGetDecBitstreamMode(mHandle);

    CHECK_EQ(mode, actualMode);

media/libstagefright/include/M4vH263Decoder.h

+0 −1
Original line number Diff line number Diff line
@@ -45,7 +45,6 @@ protected: 
private:

    sp<MediaSource> mSource;

    bool mStarted;

    bool mInitialized;

    int32_t mWidth, mHeight;



    sp<MetaData> mFormat;