diff options
| author | Marco Nelissen <marcone@google.com> | 2016-03-23 15:36:36 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-04-21 19:09:56 -0700 |
| commit | ad40e57890f81a3cf436c5f06da66396010bd9e5 (patch) | |
| tree | 443635955497f7b71ef32c2e289476620c2e961f | |
| parent | d2f47191538837e796e2b10c1ff7e1ee35f6e0ab (diff) | |
| download | frameworks_av-ad40e57890f81a3cf436c5f06da66396010bd9e5.zip frameworks_av-ad40e57890f81a3cf436c5f06da66396010bd9e5.tar.gz frameworks_av-ad40e57890f81a3cf436c5f06da66396010bd9e5.tar.bz2 | |
Check mp3 output buffer size
Bug: 27793371
Change-Id: I0fe40a4cfd0a5b488f93d3f3ba6f9495235926ac
| -rw-r--r-- | media/libstagefright/codecs/mp3dec/SoftMP3.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp index 9988015..aa946e6 100644 --- a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp +++ b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp @@ -263,6 +263,14 @@ void SoftMP3::onQueueFilled(OMX_U32 /* portIndex */) { mConfig->inputBufferUsedLength = 0; mConfig->outputFrameSize = kOutputBufferSize / sizeof(int16_t); + if ((int32)outHeader->nAllocLen < mConfig->outputFrameSize) { + ALOGE("input buffer too small: got %lu, expected %u", + outHeader->nAllocLen, mConfig->outputFrameSize); + android_errorWriteLog(0x534e4554, "27793371"); + notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL); + mSignalledError = true; + return; + } mConfig->pOutputBuffer = reinterpret_cast<int16_t *>(outHeader->pBuffer); |