diff options
| author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-02-01 17:00:37 -0800 |
|---|---|---|
| committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-02-01 17:01:26 -0800 |
| commit | 77062b4e631b8500203e45f84b2b06061be0f863 (patch) | |
| tree | 527c243ebd1f89666f7813bf15d7355589826bf9 | |
| parent | 96985edf1dd51dcf4a3bebbb2f7f2169bc619497 (diff) | |
| parent | 1e508ddce4250e04d06335fa1ceed1e1f0791da5 (diff) | |
| download | frameworks_av-77062b4e631b8500203e45f84b2b06061be0f863.zip frameworks_av-77062b4e631b8500203e45f84b2b06061be0f863.tar.gz frameworks_av-77062b4e631b8500203e45f84b2b06061be0f863.tar.bz2 | |
Merge tag 'android-6.0.1_r13' into HEAD
Android 6.0.1 release 13
Ticket: CYNGNOS-1522
Change-Id: Ie9d7be6df3e63138bafb892a3181446e3c7d844e
| -rw-r--r-- | media/libmedia/ICrypto.cpp | 4 | ||||
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp | 9 | ||||
| -rw-r--r-- | media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp | 9 |
3 files changed, 21 insertions, 1 deletions
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp index 5d822cf..bc696ca 100644 --- a/media/libmedia/ICrypto.cpp +++ b/media/libmedia/ICrypto.cpp @@ -325,7 +325,9 @@ status_t BnCrypto::onTransact( if (overflow || sumSubsampleSizes != totalSize) { result = -EINVAL; - } else if (offset + totalSize > sharedBuffer->size()) { + } else if (totalSize > sharedBuffer->size()) { + result = -EINVAL; + } else if ((size_t)offset > sharedBuffer->size() - totalSize) { result = -EINVAL; } else { result = decrypt( diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp index 8240f83..f2a4e65 100644 --- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp +++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp @@ -37,6 +37,10 @@ #include <inttypes.h> +#ifndef INT32_MAX +#define INT32_MAX 2147483647 +#endif + namespace android { template<class T> @@ -137,6 +141,11 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) { // Color conversion is needed. free(mInputFrameData); + mInputFrameData = NULL; + if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("b/25812794, Buffer size is too big."); + return OMX_ErrorBadParameter; + } mInputFrameData = (uint8_t *) malloc((mWidth * mHeight * 3 ) >> 1); CHECK(mInputFrameData != NULL); diff --git a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp index e654843..410f9d0 100644 --- a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp +++ b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp @@ -26,6 +26,10 @@ #include <media/stagefright/foundation/ADebug.h> #include <media/stagefright/MediaDefs.h> +#ifndef INT32_MAX +#define INT32_MAX 2147483647 +#endif + namespace android { template<class T> @@ -315,6 +319,11 @@ status_t SoftVPXEncoder::initEncoder() { if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) { free(mConversionBuffer); + mConversionBuffer = NULL; + if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("b/25812794, Buffer size is too big."); + return UNKNOWN_ERROR; + } mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2); if (mConversionBuffer == NULL) { ALOGE("Allocating conversion buffer failed."); |