Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ee91625 authored by Danny Baumann's avatar Danny Baumann
Browse files

Fix a couple of nasty heap corruption bugs. 

- When replacing the buffer pointer with another one, the allocated
  length wasn't updated. As the TI encoder relies of those being matched
up (it e.g. does a memset(pBuffer, 0, nAllocLen) at certain places), this
could lead to random memory being overwritten (or to a segfault when
reaching the end of the mapping)
- When replacing the buffer, the old buffer wasn't saved and restored
  before calling freeBuffer. This led to a different address passed to
free() than was returned by malloc(), could lead to all kinds of weird,
undefined behaviour.
parent 75b2e6d7

include/media/stagefright/OMXCodec.h

+2 −0
Original line number Diff line number Diff line
@@ -172,6 +172,8 @@ private: 
        size_t mSize;

        void *mData;

        MediaBuffer *mMediaBuffer;

        OMX_U8 *mAllocatedBuffer;

        size_t mAllocatedSize;

    };



    struct CodecSpecificData {

media/libstagefright/OMXCodec.cpp

+14 −0
Original line number Diff line number Diff line
@@ -2207,6 +2207,8 @@ status_t OMXCodec::allocateBuffersOnPort(OMX_U32 portIndex) { 
        BufferInfo info;

        info.mData = NULL;

        info.mSize = def.nBufferSize;

        info.mAllocatedBuffer = NULL;

        info.mAllocatedSize = 0;



        IOMX::buffer_id buffer;

        if (portIndex == kPortIndexInput
@@ -3518,6 +3520,12 @@ status_t OMXCodec::freeBuffer(OMX_U32 portIndex, size_t bufIndex) { 


    BufferInfo *info = &buffers->editItemAt(bufIndex);



    if (info->mAllocatedBuffer != NULL) {

        OMX_BUFFERHEADERTYPE *header = (OMX_BUFFERHEADERTYPE *) info->mBuffer;

        header->pBuffer = info->mAllocatedBuffer;

        header->nAllocLen = info->mAllocatedSize;

    }



    status_t err = mOMX->freeBuffer(mNode, portIndex, info->mBuffer);



    if (err == OK && info->mMediaBuffer != NULL) {
@@ -3897,8 +3905,14 @@ bool OMXCodec::drainInputBuffer(BufferInfo *info) { 
            //for encoder

            CHECK(header->pBuffer == info->mData);



            if (info->mAllocatedBuffer == NULL) {

                info->mAllocatedBuffer = header->pBuffer;

                info->mAllocatedSize = header->nAllocLen;

            }



            header->pBuffer =

                (OMX_U8 *)srcBuffer->data() + srcBuffer->range_offset();

            header->nAllocLen = srcBuffer->size() - srcBuffer->range_offset();



            releaseBuffer = false;

            info->mMediaBuffer = srcBuffer;