Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8b390cb1 authored by Arun Johnson's avatar Arun Johnson
Browse files

Checking BadOffset while queuing buffers 

Bug: 331977352

Test: atest android.mediav2.cts.CodecUnitTest$TestApi#testQueueInputBuffersWithBadOffset
Flag: codec_fwk.com.android.media.codec.flags.large_audio_frame
Change-Id: Ic95bd99a88b83885c409881d1e4d3229f4a9ca0d
parent d666832c

media/jni/android_media_MediaCodec.cpp

+7 −2
Original line number Diff line number Diff line
@@ -2099,9 +2099,14 @@ static status_t extractInfosFromObject( 
        }

        if (i == 0) {

            *initialOffset = offset;

            if (CC_UNLIKELY(*initialOffset < 0)) {

                if (errorDetailMsg) {

                    *errorDetailMsg = "Error: offset/size in BufferInfo";

                }

                return BAD_VALUE;

            }

        }

        if (CC_UNLIKELY((offset >  UINT32_MAX)

                || ((long)(offset + size) > UINT32_MAX)

        if (CC_UNLIKELY(((ssize_t)(UINT32_MAX - offset) < (ssize_t)size)

                || ((offset - *initialOffset) != *totalSize))) {

            if (errorDetailMsg) {

                *errorDetailMsg = "Error: offset/size in BufferInfo";