summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJessica Wagantall <jwagantall@cyngn.com>2016-06-07 10:19:42 -0700
committerJessica Wagantall <jwagantall@cyngn.com>2016-06-07 10:19:42 -0700
commit80c362fec14af5f22e6d3967fc4ea04b363084da (patch)
treefe282db5799ca31479a92451d5f297f80d9529d1
parent8f270dc1ec91d3b34d62202463e0b03939900449 (diff)
parentb57b3967b1a42dd505dbe4fcf1e1d810e3ae3777 (diff)
downloadframeworks_av-80c362fec14af5f22e6d3967fc4ea04b363084da.zip
frameworks_av-80c362fec14af5f22e6d3967fc4ea04b363084da.tar.gz
frameworks_av-80c362fec14af5f22e6d3967fc4ea04b363084da.tar.bz2
Merge tag 'android-6.0.1_r46' into HEAD
Android 6.0.1 release 46 Change-Id: I4fcabf5775aebd2cb8dc0e352d1b1460d3214573
-rw-r--r--include/media/stagefright/DataSource.h61
-rw-r--r--include/media/stagefright/OMXCodec.h4
-rw-r--r--media/libmedia/IOMX.cpp101
-rw-r--r--media/libstagefright/ACodec.cpp1
-rw-r--r--media/libstagefright/AudioSource.cpp4
-rw-r--r--media/libstagefright/OMXCodec.cpp44
-rw-r--r--media/libstagefright/SampleTable.cpp38
-rw-r--r--media/libstagefright/codecs/aacdec/SoftAAC2.cpp25
-rw-r--r--media/libstagefright/codecs/aacenc/SoftAACEncoder.cpp28
-rw-r--r--media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp28
-rw-r--r--media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp20
-rw-r--r--media/libstagefright/codecs/amrnb/enc/SoftAMRNBEncoder.cpp28
-rw-r--r--media/libstagefright/codecs/amrwbenc/SoftAMRWBEncoder.cpp28
-rw-r--r--media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp16
-rw-r--r--media/libstagefright/codecs/avcdec/SoftAVCDec.cpp28
-rw-r--r--media/libstagefright/codecs/avcdec/SoftAVCDec.h2
-rw-r--r--media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp30
-rw-r--r--media/libstagefright/codecs/flac/enc/SoftFlacEncoder.cpp26
-rw-r--r--media/libstagefright/codecs/g711/dec/SoftG711.cpp21
-rw-r--r--media/libstagefright/codecs/gsm/dec/SoftGSM.cpp20
-rw-r--r--media/libstagefright/codecs/hevcdec/SoftHEVC.cpp28
-rw-r--r--media/libstagefright/codecs/hevcdec/SoftHEVC.h2
-rw-r--r--media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp10
-rw-r--r--media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp24
-rw-r--r--media/libstagefright/codecs/mp3dec/SoftMP3.cpp24
-rw-r--r--media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp33
-rw-r--r--media/libstagefright/codecs/mpeg2dec/SoftMPEG2.h2
-rw-r--r--media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp121
-rw-r--r--media/libstagefright/codecs/on2/h264dec/SoftAVC.cpp26
-rw-r--r--media/libstagefright/codecs/on2/h264dec/SoftAVC.h2
-rw-r--r--media/libstagefright/codecs/on2/h264dec/inc/H264SwDecApi.h2
-rw-r--r--media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c9
-rw-r--r--media/libstagefright/codecs/on2/h264dec/source/EvaluationTestBench.c9
-rw-r--r--media/libstagefright/codecs/on2/h264dec/source/H264SwDecApi.c13
-rw-r--r--media/libstagefright/codecs/on2/h264dec/source/TestBenchMultipleInstance.c7
-rw-r--r--media/libstagefright/codecs/on2/h264dec/source/h264bsd_decoder.c2
-rw-r--r--media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.h2
-rw-r--r--media/libstagefright/codecs/opus/dec/SoftOpus.cpp23
-rw-r--r--media/libstagefright/codecs/raw/SoftRaw.cpp12
-rw-r--r--media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp29
-rw-r--r--media/libstagefright/include/SampleTable.h4
-rw-r--r--media/libstagefright/include/SoftOMXComponent.h16
-rw-r--r--media/libstagefright/omx/SimpleSoftOMXComponent.cpp8
-rw-r--r--media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp30
44 files changed, 797 insertions, 194 deletions
diff --git a/include/media/stagefright/DataSource.h b/include/media/stagefright/DataSource.h
index d627fec..c8ad05e 100644
--- a/include/media/stagefright/DataSource.h
+++ b/include/media/stagefright/DataSource.h
@@ -19,7 +19,7 @@
#define DATA_SOURCE_H_
#include <sys/types.h>
-
+#include <media/stagefright/foundation/ADebug.h>
#include <media/stagefright/MediaErrors.h>
#include <utils/Errors.h>
#include <utils/KeyedVector.h>
@@ -72,6 +72,20 @@ public:
bool getUInt32(off64_t offset, uint32_t *x);
bool getUInt64(off64_t offset, uint64_t *x);
+ // Reads in "count" entries of type T into vector *x.
+ // Returns true if "count" entries can be read.
+ // If fewer than "count" entries can be read, return false. In this case,
+ // the output vector *x will still have those entries that were read. Call
+ // x->size() to obtain the number of entries read.
+ // The optional parameter chunkSize specifies how many entries should be
+ // read from the data source at one time into a temporary buffer. Increasing
+ // chunkSize can improve the performance at the cost of extra memory usage.
+ // The default value for chunkSize is set to read at least 4k bytes at a
+ // time, depending on sizeof(T).
+ template <typename T>
+ bool getVector(off64_t offset, Vector<T>* x, size_t count,
+ size_t chunkSize = (4095 / sizeof(T)) + 1);
+
// May return ERROR_UNSUPPORTED.
virtual status_t getSize(off64_t *size);
@@ -128,6 +142,51 @@ private:
DataSource &operator=(const DataSource &);
};
+template <typename T>
+bool DataSource::getVector(off64_t offset, Vector<T>* x, size_t count,
+ size_t chunkSize)
+{
+ x->clear();
+ if (chunkSize == 0) {
+ return false;
+ }
+ if (count == 0) {
+ return true;
+ }
+
+ T tmp[chunkSize];
+ ssize_t numBytesRead;
+ size_t numBytesPerChunk = chunkSize * sizeof(T);
+ size_t i;
+
+ for (i = 0; i + chunkSize < count; i += chunkSize) {
+ // This loops is executed when more than chunkSize records need to be
+ // read.
+ numBytesRead = this->readAt(offset, (void*)&tmp, numBytesPerChunk);
+ if (numBytesRead == -1) { // If readAt() returns -1, there is an error.
+ return false;
+ }
+ if (numBytesRead < numBytesPerChunk) {
+ // This case is triggered when the stream ends before the whole
+ // chunk is read.
+ x->appendArray(tmp, (size_t)numBytesRead / sizeof(T));
+ return false;
+ }
+ x->appendArray(tmp, chunkSize);
+ offset += numBytesPerChunk;
+ }
+
+ // There are (count - i) more records to read.
+ // Right now, (count - i) <= chunkSize.
+ // We do the same thing as above, but with chunkSize replaced by count - i.
+ numBytesRead = this->readAt(offset, (void*)&tmp, (count - i) * sizeof(T));
+ if (numBytesRead == -1) {
+ return false;
+ }
+ x->appendArray(tmp, (size_t)numBytesRead / sizeof(T));
+ return x->size() == count;
+}
+
} // namespace android
#endif // DATA_SOURCE_H_
diff --git a/include/media/stagefright/OMXCodec.h b/include/media/stagefright/OMXCodec.h
index ea534e0..2f73de8 100644
--- a/include/media/stagefright/OMXCodec.h
+++ b/include/media/stagefright/OMXCodec.h
@@ -40,10 +40,6 @@ struct OMXCodec : public MediaSource,
kPreferSoftwareCodecs = 1,
kIgnoreCodecSpecificData = 2,
- // The client wants to access the output buffer's video
- // data for example for thumbnail extraction.
- kClientNeedsFramebuffer = 4,
-
// Request for software or hardware codecs. If request
// can not be fullfilled, Create() returns NULL.
kSoftwareCodecsOnly = 8,
diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 346c37e..ab2d179 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -18,11 +18,14 @@
#define LOG_TAG "IOMX"
#include <utils/Log.h>
+#include <sys/mman.h>
+
#include <binder/IMemory.h>
#include <binder/Parcel.h>
#include <media/IOMX.h>
#include <media/stagefright/foundation/ADebug.h>
#include <media/AVMediaExtensions.h>
+#include <media/openmax/OMX_IndexExt.h>
namespace android {
@@ -694,38 +697,74 @@ status_t BnOMX::onTransact(
size_t size = data.readInt64();
- status_t err = NO_MEMORY;
- void *params = calloc(size, 1);
- if (params) {
- err = data.read(params, size);
- if (err != OK) {
- android_errorWriteLog(0x534e4554, "26914474");
+ status_t err = NOT_ENOUGH_DATA;
+ void *params = NULL;
+ size_t pageSize = 0;
+ size_t allocSize = 0;
+ bool isUsageBits = (index == (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits);
+ if ((isUsageBits && size < 4) ||
+ (!isUsageBits && code != SET_INTERNAL_OPTION && size < 8)) {
+ // we expect the structure to contain at least the size and
+ // version, 8 bytes total
+ ALOGE("b/27207275 (%zu) (%d/%d)", size, int(index), int(code));
+ android_errorWriteLog(0x534e4554, "27207275");
+ } else {
+ err = NO_MEMORY;
+ pageSize = (size_t) sysconf(_SC_PAGE_SIZE);
+ if (size > SIZE_MAX - (pageSize * 2)) {
+ ALOGE("requested param size too big");
} else {
- switch (code) {
- case GET_PARAMETER:
- err = getParameter(node, index, params, size);
- break;
- case SET_PARAMETER:
- err = setParameter(node, index, params, size);
- break;
- case GET_CONFIG:
- err = getConfig(node, index, params, size);
- break;
- case SET_CONFIG:
- err = setConfig(node, index, params, size);
- break;
- case SET_INTERNAL_OPTION:
- {
- InternalOptionType type =
- (InternalOptionType)data.readInt32();
-
- err = setInternalOption(node, index, type, params, size);
- break;
+ allocSize = (size + pageSize * 2) & ~(pageSize - 1);
+ params = mmap(NULL, allocSize, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1 /* fd */, 0 /* offset */);
+ }
+ if (params != MAP_FAILED) {
+ err = data.read(params, size);
+ if (err != OK) {
+ android_errorWriteLog(0x534e4554, "26914474");
+ } else {
+ err = NOT_ENOUGH_DATA;
+ OMX_U32 declaredSize = *(OMX_U32*)params;
+ if (code != SET_INTERNAL_OPTION &&
+ index != (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits &&
+ declaredSize > size) {
+ // the buffer says it's bigger than it actually is
+ ALOGE("b/27207275 (%u/%zu)", declaredSize, size);
+ android_errorWriteLog(0x534e4554, "27207275");
+ } else {
+ // mark the last page as inaccessible, to avoid exploitation
+ // of codecs that access past the end of the allocation because
+ // they didn't check the size
+ mprotect((char*)params + allocSize - pageSize, pageSize, PROT_NONE);
+ switch (code) {
+ case GET_PARAMETER:
+ err = getParameter(node, index, params, size);
+ break;
+ case SET_PARAMETER:
+ err = setParameter(node, index, params, size);
+ break;
+ case GET_CONFIG:
+ err = getConfig(node, index, params, size);
+ break;
+ case SET_CONFIG:
+ err = setConfig(node, index, params, size);
+ break;
+ case SET_INTERNAL_OPTION:
+ {
+ InternalOptionType type =
+ (InternalOptionType)data.readInt32();
+
+ err = setInternalOption(node, index, type, params, size);
+ break;
+ }
+
+ default:
+ TRESPASS();
+ }
}
-
- default:
- TRESPASS();
}
+ } else {
+ ALOGE("couldn't map: %s", strerror(errno));
}
}
@@ -735,7 +774,9 @@ status_t BnOMX::onTransact(
reply->write(params, size);
}
- free(params);
+ if (params) {
+ munmap(params, allocSize);
+ }
params = NULL;
return NO_ERROR;
diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp
index b83d6c6..427728f 100644
--- a/media/libstagefright/ACodec.cpp
+++ b/media/libstagefright/ACodec.cpp
@@ -2535,6 +2535,7 @@ status_t ACodec::setupAACCodec(
: OMX_AUDIO_AACStreamFormatMP4FF;
OMX_AUDIO_PARAM_ANDROID_AACPRESENTATIONTYPE presentation;
+ InitOMXParams(&presentation);
presentation.nMaxOutputChannels = maxOutputChannelCount;
presentation.nDrcCut = drc.drcCut;
presentation.nDrcBoost = drc.drcBoost;
diff --git a/media/libstagefright/AudioSource.cpp b/media/libstagefright/AudioSource.cpp
index 78fc3b8..77a7d1c 100644
--- a/media/libstagefright/AudioSource.cpp
+++ b/media/libstagefright/AudioSource.cpp
@@ -55,8 +55,12 @@ AudioSource::AudioSource(
: mStarted(false),
mSampleRate(sampleRate),
mOutSampleRate(outSampleRate > 0 ? outSampleRate : sampleRate),
+ mTrackMaxAmplitude(false),
+ mStartTimeUs(0),
+ mMaxAmplitude(0),
mPrevSampleTimeUs(0),
mFirstSampleTimeUs(-1ll),
+ mInitialReadTimeUs(0),
mNumFramesReceived(0),
mNumClientOwnedBuffers(0),
mRecPaused(false) {
diff --git a/media/libstagefright/OMXCodec.cpp b/media/libstagefright/OMXCodec.cpp
index 7f97039..af30780 100644
--- a/media/libstagefright/OMXCodec.cpp
+++ b/media/libstagefright/OMXCodec.cpp
@@ -355,21 +355,6 @@ sp<MediaSource> OMXCodec::Create(
ALOGV("Attempting to allocate OMX node '%s'", componentName);
- if (!createEncoder
- && (quirks & kOutputBuffersAreUnreadable)
- && (flags & kClientNeedsFramebuffer)) {
- if (strncmp(componentName, "OMX.SEC.", 8)) {
- // For OMX.SEC.* decoders we can enable a special mode that
- // gives the client access to the framebuffer contents.
-
- ALOGW("Component '%s' does not give the client access to "
- "the framebuffer contents. Skipping.",
- componentName);
-
- continue;
- }
- }
-
status_t err = omx->allocateNode(componentName, observer, &node);
if (err == OK) {
ALOGV("Successfully allocated OMX node '%s'", componentName);
@@ -681,35 +666,6 @@ status_t OMXCodec::configureCodec(const sp<MetaData> &meta) {
initOutputFormat(meta);
- if ((mFlags & kClientNeedsFramebuffer)
- && !strncmp(mComponentName, "OMX.SEC.", 8)) {
- // This appears to no longer be needed???
-
- OMX_INDEXTYPE index;
-
- status_t err =
- mOMX->getExtensionIndex(
- mNode,
- "OMX.SEC.index.ThumbnailMode",
- &index);
-
- if (err != OK) {
- return err;
- }
-
- OMX_BOOL enable = OMX_TRUE;
- err = mOMX->setConfig(mNode, index, &enable, sizeof(enable));
-
- if (err != OK) {
- CODEC_LOGE("setConfig('OMX.SEC.index.ThumbnailMode') "
- "returned error 0x%08x", err);
-
- return err;
- }
-
- mQuirks &= ~kOutputBuffersAreUnreadable;
- }
-
if (mNativeWindow != NULL
&& !mIsEncoder
&& !strncasecmp(mMIME, "video/", 6)
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index 2f69fd8..7d8d184 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -121,8 +121,9 @@ SampleTable::SampleTable(const sp<DataSource> &source)
mSampleSizeFieldSize(0),
mDefaultSampleSize(0),
mNumSampleSizes(0),
+ mHasTimeToSample(false),
mTimeToSampleCount(0),
- mTimeToSample(NULL),
+ mTimeToSample(),
mSampleTimeEntries(NULL),
mCompositionTimeDeltaEntries(NULL),
mNumCompositionTimeDeltaEntries(0),
@@ -151,9 +152,6 @@ SampleTable::~SampleTable() {
delete[] mSampleTimeEntries;
mSampleTimeEntries = NULL;
- delete[] mTimeToSample;
- mTimeToSample = NULL;
-
delete mSampleIterator;
mSampleIterator = NULL;
}
@@ -162,7 +160,7 @@ bool SampleTable::isValid() const {
return mChunkOffsetOffset >= 0
&& mSampleToChunkOffset >= 0
&& mSampleSizeOffset >= 0
- && mTimeToSample != NULL;
+ && mHasTimeToSample;
}
status_t SampleTable::setChunkOffsetParams(
@@ -337,7 +335,7 @@ status_t SampleTable::setSampleSizeParams(
status_t SampleTable::setTimeToSampleParams(
off64_t data_offset, size_t data_size) {
- if (mTimeToSample != NULL || data_size < 8) {
+ if (mHasTimeToSample || data_size < 8) {
return ERROR_MALFORMED;
}
@@ -353,24 +351,32 @@ status_t SampleTable::setTimeToSampleParams(
}
mTimeToSampleCount = U32_AT(&header[4]);
- uint64_t allocSize = (uint64_t)mTimeToSampleCount * 2 * sizeof(uint32_t);
- if (allocSize > UINT32_MAX) {
+ if ((uint64_t)mTimeToSampleCount >
+ (uint64_t)UINT32_MAX / (2 * sizeof(uint32_t))) {
+ // Choose this bound because
+ // 1) 2 * sizeof(uint32_t) is the amount of memory needed for one
+ // time-to-sample entry in the time-to-sample table.
+ // 2) mTimeToSampleCount is the number of entries of the time-to-sample
+ // table.
+ // 3) We hope that the table size does not exceed UINT32_MAX.
+ ALOGE(" Error: Time-to-sample table size too large.");
+
return ERROR_OUT_OF_RANGE;
}
- mTimeToSample = new (std::nothrow) uint32_t[mTimeToSampleCount * 2];
- if (!mTimeToSample)
- return ERROR_OUT_OF_RANGE;
- size_t size = sizeof(uint32_t) * mTimeToSampleCount * 2;
- if (mDataSource->readAt(
- data_offset + 8, mTimeToSample, size) < (ssize_t)size) {
+ // Note: At this point, we know that mTimeToSampleCount * 2 will not
+ // overflow because of the above condition.
+ if (!mDataSource->getVector(data_offset + 8, &mTimeToSample,
+ mTimeToSampleCount * 2)) {
+ ALOGE(" Error: Incomplete data read for time-to-sample table.");
return ERROR_IO;
}
- for (uint32_t i = 0; i < mTimeToSampleCount * 2; ++i) {
- mTimeToSample[i] = ntohl(mTimeToSample[i]);
+ for (size_t i = 0; i < mTimeToSample.size(); ++i) {
+ mTimeToSample.editItemAt(i) = ntohl(mTimeToSample[i]);
}
+ mHasTimeToSample = true;
return OK;
}
diff --git a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
index c945305..791b86e 100644
--- a/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
+++ b/media/libstagefright/codecs/aacdec/SoftAAC2.cpp
@@ -211,6 +211,10 @@ OMX_ERRORTYPE SoftAAC2::internalGetParameter(
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -246,6 +250,10 @@ OMX_ERRORTYPE SoftAAC2::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -286,6 +294,10 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.aac",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -300,6 +312,10 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
const OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
(const OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -320,6 +336,11 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
{
const OMX_AUDIO_PARAM_ANDROID_AACPRESENTATIONTYPE *aacPresParams =
(const OMX_AUDIO_PARAM_ANDROID_AACPRESENTATIONTYPE *)params;
+
+ if (!isValidOMXParam(aacPresParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
// for the following parameters of the OMX_AUDIO_PARAM_AACPROFILETYPE structure,
// a value of -1 implies the parameter is not set by the application:
// nMaxOutputChannels uses default platform properties, see configureDownmix()
@@ -386,6 +407,10 @@ OMX_ERRORTYPE SoftAAC2::internalSetParameter(
const OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/aacenc/SoftAACEncoder.cpp b/media/libstagefright/codecs/aacenc/SoftAACEncoder.cpp
index c6724c2..ab0a228 100644
--- a/media/libstagefright/codecs/aacenc/SoftAACEncoder.cpp
+++ b/media/libstagefright/codecs/aacenc/SoftAACEncoder.cpp
@@ -154,6 +154,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -174,6 +178,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalGetParameter(
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -198,6 +206,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -229,6 +241,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_encoder.aac",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -243,6 +259,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
const OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(const OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -266,6 +286,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -286,6 +310,10 @@ OMX_ERRORTYPE SoftAACEncoder::internalSetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
index 35aa883..e8dabed 100644
--- a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
+++ b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
@@ -123,6 +123,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -143,6 +147,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -202,6 +210,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -233,6 +245,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_encoder.aac",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -247,6 +263,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
const OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(const OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -270,6 +290,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
OMX_AUDIO_PARAM_AACPROFILETYPE *aacParams =
(OMX_AUDIO_PARAM_AACPROFILETYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -310,6 +334,10 @@ OMX_ERRORTYPE SoftAACEncoder2::internalSetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp b/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp
index 955309a..edf648d 100644
--- a/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp
+++ b/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp
@@ -148,6 +148,10 @@ OMX_ERRORTYPE SoftAMR::internalGetParameter(
OMX_AUDIO_PARAM_AMRTYPE *amrParams =
(OMX_AUDIO_PARAM_AMRTYPE *)params;
+ if (!isValidOMXParam(amrParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (amrParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -174,6 +178,10 @@ OMX_ERRORTYPE SoftAMR::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -207,6 +215,10 @@ OMX_ERRORTYPE SoftAMR::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (mMode == MODE_NARROW) {
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.amrnb",
@@ -229,6 +241,10 @@ OMX_ERRORTYPE SoftAMR::internalSetParameter(
const OMX_AUDIO_PARAM_AMRTYPE *aacParams =
(const OMX_AUDIO_PARAM_AMRTYPE *)params;
+ if (!isValidOMXParam(aacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (aacParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -241,6 +257,10 @@ OMX_ERRORTYPE SoftAMR::internalSetParameter(
const OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/amrnb/enc/SoftAMRNBEncoder.cpp b/media/libstagefright/codecs/amrnb/enc/SoftAMRNBEncoder.cpp
index 9489457..aaa6731 100644
--- a/media/libstagefright/codecs/amrnb/enc/SoftAMRNBEncoder.cpp
+++ b/media/libstagefright/codecs/amrnb/enc/SoftAMRNBEncoder.cpp
@@ -120,6 +120,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -140,6 +144,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalGetParameter(
OMX_AUDIO_PARAM_AMRTYPE *amrParams =
(OMX_AUDIO_PARAM_AMRTYPE *)params;
+ if (!isValidOMXParam(amrParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (amrParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -158,6 +166,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -188,6 +200,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_encoder.amrnb",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -202,6 +218,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalSetParameter(
const OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(const OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -225,6 +245,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalSetParameter(
OMX_AUDIO_PARAM_AMRTYPE *amrParams =
(OMX_AUDIO_PARAM_AMRTYPE *)params;
+ if (!isValidOMXParam(amrParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (amrParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -252,6 +276,10 @@ OMX_ERRORTYPE SoftAMRNBEncoder::internalSetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/amrwbenc/SoftAMRWBEncoder.cpp b/media/libstagefright/codecs/amrwbenc/SoftAMRWBEncoder.cpp
index 91a512d..9d50c4e 100644
--- a/media/libstagefright/codecs/amrwbenc/SoftAMRWBEncoder.cpp
+++ b/media/libstagefright/codecs/amrwbenc/SoftAMRWBEncoder.cpp
@@ -155,6 +155,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -175,6 +179,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalGetParameter(
OMX_AUDIO_PARAM_AMRTYPE *amrParams =
(OMX_AUDIO_PARAM_AMRTYPE *)params;
+ if (!isValidOMXParam(amrParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (amrParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -196,6 +204,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -226,6 +238,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_encoder.amrwb",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -240,6 +256,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalSetParameter(
const OMX_AUDIO_PARAM_PORTFORMATTYPE *formatParams =
(const OMX_AUDIO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -263,6 +283,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalSetParameter(
OMX_AUDIO_PARAM_AMRTYPE *amrParams =
(OMX_AUDIO_PARAM_AMRTYPE *)params;
+ if (!isValidOMXParam(amrParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (amrParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -299,6 +323,10 @@ OMX_ERRORTYPE SoftAMRWBEncoder::internalSetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp b/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp
index fa6ec40..cce6d15 100644
--- a/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp
+++ b/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp
@@ -370,6 +370,10 @@ OMX_ERRORTYPE SoftAVCEncoder::internalGetParameter(
OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
(OMX_VIDEO_PARAM_BITRATETYPE *) params;
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (bitRate->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -384,6 +388,10 @@ OMX_ERRORTYPE SoftAVCEncoder::internalGetParameter(
OMX_VIDEO_PARAM_AVCTYPE *avcParams =
(OMX_VIDEO_PARAM_AVCTYPE *)params;
+ if (!isValidOMXParam(avcParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (avcParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -427,6 +435,10 @@ OMX_ERRORTYPE SoftAVCEncoder::internalSetParameter(
OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
(OMX_VIDEO_PARAM_BITRATETYPE *) params;
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (bitRate->nPortIndex != 1 ||
bitRate->eControlRate != OMX_Video_ControlRateVariable) {
return OMX_ErrorUndefined;
@@ -441,6 +453,10 @@ OMX_ERRORTYPE SoftAVCEncoder::internalSetParameter(
OMX_VIDEO_PARAM_AVCTYPE *avcType =
(OMX_VIDEO_PARAM_AVCTYPE *)params;
+ if (!isValidOMXParam(avcType)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (avcType->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp b/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp
index afbe230..2130ccf 100644
--- a/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp
+++ b/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp
@@ -381,7 +381,7 @@ void SoftAVC::onReset() {
resetPlugin();
}
-void SoftAVC::setDecodeArgs(
+bool SoftAVC::setDecodeArgs(
ivd_video_decode_ip_t *ps_dec_ip,
ivd_video_decode_op_t *ps_dec_op,
OMX_BUFFERHEADERTYPE *inHeader,
@@ -389,7 +389,6 @@ void SoftAVC::setDecodeArgs(
size_t timeStampIx) {
size_t sizeY = outputBufferWidth() * outputBufferHeight();
size_t sizeUV;
- uint8_t *pBuf;
ps_dec_ip->u4_size = sizeof(ivd_video_decode_ip_t);
ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
@@ -409,22 +408,28 @@ void SoftAVC::setDecodeArgs(
ps_dec_ip->u4_num_Bytes = 0;
}
+ sizeUV = sizeY / 4;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;
+
+ uint8_t *pBuf;
if (outHeader) {
+ if (outHeader->nAllocLen < sizeY + (sizeUV * 2)) {
+ android_errorWriteLog(0x534e4554, "27569635");
+ return false;
+ }
pBuf = outHeader->pBuffer;
} else {
+ // mFlushOutBuffer always has the right size.
pBuf = mFlushOutBuffer;
}
- sizeUV = sizeY / 4;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;
-
ps_dec_ip->s_out_buffer.pu1_bufs[0] = pBuf;
ps_dec_ip->s_out_buffer.pu1_bufs[1] = pBuf + sizeY;
ps_dec_ip->s_out_buffer.pu1_bufs[2] = pBuf + sizeY + sizeUV;
ps_dec_ip->s_out_buffer.u4_num_bufs = 3;
- return;
+ return true;
}
void SoftAVC::onPortFlushCompleted(OMX_U32 portIndex) {
/* Once the output buffers are flushed, ignore any buffers that are held in decoder */
@@ -573,7 +578,12 @@ void SoftAVC::onQueueFilled(OMX_U32 portIndex) {
WORD32 timeDelay, timeTaken;
size_t sizeY, sizeUV;
- setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx);
+ if (!setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx)) {
+ ALOGE("Decoder arg setup failed");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
// If input dump is enabled, then write to file
DUMP_TO_FILE(mInFile, s_dec_ip.pv_stream_buffer, s_dec_ip.u4_num_Bytes);
diff --git a/media/libstagefright/codecs/avcdec/SoftAVCDec.h b/media/libstagefright/codecs/avcdec/SoftAVCDec.h
index 9dcabb4..c710c76 100644
--- a/media/libstagefright/codecs/avcdec/SoftAVCDec.h
+++ b/media/libstagefright/codecs/avcdec/SoftAVCDec.h
@@ -109,7 +109,7 @@ private:
status_t resetPlugin();
- void setDecodeArgs(
+ bool setDecodeArgs(
ivd_video_decode_ip_t *ps_dec_ip,
ivd_video_decode_op_t *ps_dec_op,
OMX_BUFFERHEADERTYPE *inHeader,
diff --git a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
index 387d17d..e4e8fd7 100644
--- a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
+++ b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
@@ -926,6 +926,10 @@ OMX_ERRORTYPE SoftAVC::internalGetParameter(OMX_INDEXTYPE index, OMX_PTR params)
OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
(OMX_VIDEO_PARAM_BITRATETYPE *)params;
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (bitRate->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -939,6 +943,10 @@ OMX_ERRORTYPE SoftAVC::internalGetParameter(OMX_INDEXTYPE index, OMX_PTR params)
{
OMX_VIDEO_PARAM_AVCTYPE *avcParams = (OMX_VIDEO_PARAM_AVCTYPE *)params;
+ if (!isValidOMXParam(avcParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (avcParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -976,14 +984,24 @@ OMX_ERRORTYPE SoftAVC::internalSetParameter(OMX_INDEXTYPE index, const OMX_PTR p
switch (indexFull) {
case OMX_IndexParamVideoBitrate:
{
- return internalSetBitrateParams(
- (const OMX_VIDEO_PARAM_BITRATETYPE *)params);
+ OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
+ (OMX_VIDEO_PARAM_BITRATETYPE *)params;
+
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
+ return internalSetBitrateParams(bitRate);
}
case OMX_IndexParamVideoAvc:
{
OMX_VIDEO_PARAM_AVCTYPE *avcType = (OMX_VIDEO_PARAM_AVCTYPE *)params;
+ if (!isValidOMXParam(avcType)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (avcType->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -1035,6 +1053,10 @@ OMX_ERRORTYPE SoftAVC::setConfig(
OMX_CONFIG_INTRAREFRESHVOPTYPE *params =
(OMX_CONFIG_INTRAREFRESHVOPTYPE *)_params;
+ if (!isValidOMXParam(params)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (params->nPortIndex != kOutputPortIndex) {
return OMX_ErrorBadPortIndex;
}
@@ -1048,6 +1070,10 @@ OMX_ERRORTYPE SoftAVC::setConfig(
OMX_VIDEO_CONFIG_BITRATETYPE *params =
(OMX_VIDEO_CONFIG_BITRATETYPE *)_params;
+ if (!isValidOMXParam(params)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (params->nPortIndex != kOutputPortIndex) {
return OMX_ErrorBadPortIndex;
}
diff --git a/media/libstagefright/codecs/flac/enc/SoftFlacEncoder.cpp b/media/libstagefright/codecs/flac/enc/SoftFlacEncoder.cpp
index 9edffd2..caceda9 100644
--- a/media/libstagefright/codecs/flac/enc/SoftFlacEncoder.cpp
+++ b/media/libstagefright/codecs/flac/enc/SoftFlacEncoder.cpp
@@ -159,6 +159,10 @@ OMX_ERRORTYPE SoftFlacEncoder::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -180,6 +184,11 @@ OMX_ERRORTYPE SoftFlacEncoder::internalGetParameter(
case OMX_IndexParamAudioFlac:
{
OMX_AUDIO_PARAM_FLACTYPE *flacParams = (OMX_AUDIO_PARAM_FLACTYPE *)params;
+
+ if (!isValidOMXParam(flacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
flacParams->nCompressionLevel = mCompressionLevel;
flacParams->nChannels = mNumChannels;
flacParams->nSampleRate = mSampleRate;
@@ -199,6 +208,10 @@ OMX_ERRORTYPE SoftFlacEncoder::internalSetParameter(
ALOGV("SoftFlacEncoder::internalSetParameter(OMX_IndexParamAudioPcm)");
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams = (OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0 && pcmParams->nPortIndex != 1) {
ALOGE("SoftFlacEncoder::internalSetParameter() Error #1");
return OMX_ErrorUndefined;
@@ -221,6 +234,10 @@ OMX_ERRORTYPE SoftFlacEncoder::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_encoder.flac",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -236,6 +253,11 @@ OMX_ERRORTYPE SoftFlacEncoder::internalSetParameter(
{
// used only for setting the compression level
OMX_AUDIO_PARAM_FLACTYPE *flacParams = (OMX_AUDIO_PARAM_FLACTYPE *)params;
+
+ if (!isValidOMXParam(flacParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
mCompressionLevel = flacParams->nCompressionLevel; // range clamping done inside encoder
return OMX_ErrorNone;
}
@@ -245,6 +267,10 @@ OMX_ERRORTYPE SoftFlacEncoder::internalSetParameter(
OMX_PARAM_PORTDEFINITIONTYPE *defParams =
(OMX_PARAM_PORTDEFINITIONTYPE *)params;
+ if (!isValidOMXParam(defParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (defParams->nPortIndex == 0) {
if (defParams->nBufferSize > kMaxInputBufferSize) {
ALOGE("Input buffer size must be at most %d bytes",
diff --git a/media/libstagefright/codecs/g711/dec/SoftG711.cpp b/media/libstagefright/codecs/g711/dec/SoftG711.cpp
index 015515e..c8277de 100644
--- a/media/libstagefright/codecs/g711/dec/SoftG711.cpp
+++ b/media/libstagefright/codecs/g711/dec/SoftG711.cpp
@@ -110,6 +110,10 @@ OMX_ERRORTYPE SoftG711::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -148,6 +152,10 @@ OMX_ERRORTYPE SoftG711::internalSetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0 && pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -170,6 +178,10 @@ OMX_ERRORTYPE SoftG711::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (mIsMLaw) {
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.g711mlaw",
@@ -228,6 +240,15 @@ void SoftG711::onQueueFilled(OMX_U32 /* portIndex */) {
mSignalledError = true;
}
+ if (inHeader->nFilledLen * sizeof(int16_t) > outHeader->nAllocLen) {
+ ALOGE("output buffer too small (%d).", outHeader->nAllocLen);
+ android_errorWriteLog(0x534e4554, "27793163");
+
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
+
const uint8_t *inputptr = inHeader->pBuffer + inHeader->nOffset;
if (mIsMLaw) {
diff --git a/media/libstagefright/codecs/gsm/dec/SoftGSM.cpp b/media/libstagefright/codecs/gsm/dec/SoftGSM.cpp
index bd01a1a..04d5a33 100644
--- a/media/libstagefright/codecs/gsm/dec/SoftGSM.cpp
+++ b/media/libstagefright/codecs/gsm/dec/SoftGSM.cpp
@@ -110,6 +110,10 @@ OMX_ERRORTYPE SoftGSM::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -141,6 +145,10 @@ OMX_ERRORTYPE SoftGSM::internalSetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0 && pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -161,6 +169,10 @@ OMX_ERRORTYPE SoftGSM::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.gsm",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -216,6 +228,14 @@ void SoftGSM::onQueueFilled(OMX_U32 /* portIndex */) {
mSignalledError = true;
}
+ if (outHeader->nAllocLen < (inHeader->nFilledLen / kMSGSMFrameSize) * 320) {
+ ALOGE("output buffer is not large enough (%d).", outHeader->nAllocLen);
+ android_errorWriteLog(0x534e4554, "27793367");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
+
uint8_t *inputptr = inHeader->pBuffer + inHeader->nOffset;
int n = mSignalledError ? 0 : DecodeGSM(mGsm,
diff --git a/media/libstagefright/codecs/hevcdec/SoftHEVC.cpp b/media/libstagefright/codecs/hevcdec/SoftHEVC.cpp
index e601125..a70755c 100644
--- a/media/libstagefright/codecs/hevcdec/SoftHEVC.cpp
+++ b/media/libstagefright/codecs/hevcdec/SoftHEVC.cpp
@@ -343,14 +343,13 @@ void SoftHEVC::onReset() {
resetPlugin();
}
-void SoftHEVC::setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,
+bool SoftHEVC::setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,
ivd_video_decode_op_t *ps_dec_op,
OMX_BUFFERHEADERTYPE *inHeader,
OMX_BUFFERHEADERTYPE *outHeader,
size_t timeStampIx) {
size_t sizeY = outputBufferWidth() * outputBufferHeight();
size_t sizeUV;
- uint8_t *pBuf;
ps_dec_ip->u4_size = sizeof(ivd_video_decode_ip_t);
ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
@@ -370,22 +369,28 @@ void SoftHEVC::setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,
ps_dec_ip->u4_num_Bytes = 0;
}
+ sizeUV = sizeY / 4;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;
+
+ uint8_t *pBuf;
if (outHeader) {
+ if (outHeader->nAllocLen < sizeY + (sizeUV * 2)) {
+ android_errorWriteLog(0x534e4554, "27569635");
+ return false;
+ }
pBuf = outHeader->pBuffer;
} else {
+ // mFlushOutBuffer always has the right size.
pBuf = mFlushOutBuffer;
}
- sizeUV = sizeY / 4;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;
-
ps_dec_ip->s_out_buffer.pu1_bufs[0] = pBuf;
ps_dec_ip->s_out_buffer.pu1_bufs[1] = pBuf + sizeY;
ps_dec_ip->s_out_buffer.pu1_bufs[2] = pBuf + sizeY + sizeUV;
ps_dec_ip->s_out_buffer.u4_num_bufs = 3;
- return;
+ return true;
}
void SoftHEVC::onPortFlushCompleted(OMX_U32 portIndex) {
/* Once the output buffers are flushed, ignore any buffers that are held in decoder */
@@ -520,7 +525,12 @@ void SoftHEVC::onQueueFilled(OMX_U32 portIndex) {
WORD32 timeDelay, timeTaken;
size_t sizeY, sizeUV;
- setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx);
+ if (!setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx)) {
+ ALOGE("Decoder arg setup failed");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
GETTIME(&mTimeStart, NULL);
/* Compute time elapsed between end of previous decode()
diff --git a/media/libstagefright/codecs/hevcdec/SoftHEVC.h b/media/libstagefright/codecs/hevcdec/SoftHEVC.h
index 21bb99e..943edfd 100644
--- a/media/libstagefright/codecs/hevcdec/SoftHEVC.h
+++ b/media/libstagefright/codecs/hevcdec/SoftHEVC.h
@@ -106,7 +106,7 @@ private:
status_t resetDecoder();
status_t resetPlugin();
- void setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,
+ bool setDecodeArgs(ivd_video_decode_ip_t *ps_dec_ip,
ivd_video_decode_op_t *ps_dec_op,
OMX_BUFFERHEADERTYPE *inHeader,
OMX_BUFFERHEADERTYPE *outHeader,
diff --git a/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp b/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp
index 0c1a149..bb59ae4 100644
--- a/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp
@@ -229,6 +229,14 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) {
int32_t bufferSize = inHeader->nFilledLen;
int32_t tmp = bufferSize;
+ OMX_U32 frameSize = (mWidth * mHeight * 3) / 2;
+ if (outHeader->nAllocLen < frameSize) {
+ android_errorWriteLog(0x534e4554, "27833616");
+ ALOGE("Insufficient output buffer size");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
// The PV decoder is lying to us, sometimes it'll claim to only have
// consumed a subset of the buffer when it clearly consumed all of it.
// ignore whatever it says...
@@ -272,7 +280,7 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) {
++mInputBufferCount;
outHeader->nOffset = 0;
- outHeader->nFilledLen = (mWidth * mHeight * 3) / 2;
+ outHeader->nFilledLen = frameSize;
List<BufferInfo *>::iterator it = outQueue.begin();
while ((*it)->mHeader != outHeader) {
diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp
index f2a4e65..7638bb7 100644
--- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp
+++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp
@@ -232,6 +232,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalGetParameter(
OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
(OMX_VIDEO_PARAM_BITRATETYPE *) params;
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (bitRate->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -246,6 +250,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalGetParameter(
OMX_VIDEO_PARAM_H263TYPE *h263type =
(OMX_VIDEO_PARAM_H263TYPE *)params;
+ if (!isValidOMXParam(h263type)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (h263type->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -267,6 +275,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalGetParameter(
OMX_VIDEO_PARAM_MPEG4TYPE *mpeg4type =
(OMX_VIDEO_PARAM_MPEG4TYPE *)params;
+ if (!isValidOMXParam(mpeg4type)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (mpeg4type->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -301,6 +313,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalSetParameter(
OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
(OMX_VIDEO_PARAM_BITRATETYPE *) params;
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (bitRate->nPortIndex != 1 ||
bitRate->eControlRate != OMX_Video_ControlRateVariable) {
return OMX_ErrorUndefined;
@@ -315,6 +331,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalSetParameter(
OMX_VIDEO_PARAM_H263TYPE *h263type =
(OMX_VIDEO_PARAM_H263TYPE *)params;
+ if (!isValidOMXParam(h263type)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (h263type->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -337,6 +357,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalSetParameter(
OMX_VIDEO_PARAM_MPEG4TYPE *mpeg4type =
(OMX_VIDEO_PARAM_MPEG4TYPE *)params;
+ if (!isValidOMXParam(mpeg4type)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (mpeg4type->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
index 4c4da60..ba13338 100644
--- a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
+++ b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
@@ -130,6 +130,10 @@ OMX_ERRORTYPE SoftMP3::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -153,6 +157,10 @@ OMX_ERRORTYPE SoftMP3::internalGetParameter(
OMX_AUDIO_PARAM_MP3TYPE *mp3Params =
(OMX_AUDIO_PARAM_MP3TYPE *)params;
+ if (!isValidOMXParam(mp3Params)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (mp3Params->nPortIndex > 1) {
return OMX_ErrorUndefined;
}
@@ -178,6 +186,10 @@ OMX_ERRORTYPE SoftMP3::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.mp3",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -192,6 +204,10 @@ OMX_ERRORTYPE SoftMP3::internalSetParameter(
const OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(const OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -262,6 +278,14 @@ void SoftMP3::onQueueFilled(OMX_U32 /* portIndex */) {
mConfig->inputBufferUsedLength = 0;
mConfig->outputFrameSize = kOutputBufferSize / sizeof(int16_t);
+ if ((int32)outHeader->nAllocLen < mConfig->outputFrameSize) {
+ ALOGE("input buffer too small: got %lu, expected %u",
+ outHeader->nAllocLen, mConfig->outputFrameSize);
+ android_errorWriteLog(0x534e4554, "27793371");
+ notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL);
+ mSignalledError = true;
+ return;
+ }
mConfig->pOutputBuffer =
reinterpret_cast<int16_t *>(outHeader->pBuffer);
diff --git a/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp b/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp
index 4307c4e..e134d38 100644
--- a/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp
+++ b/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.cpp
@@ -466,7 +466,7 @@ OMX_ERRORTYPE SoftMPEG2::internalSetParameter(OMX_INDEXTYPE index, const OMX_PTR
return ret;
}
-void SoftMPEG2::setDecodeArgs(
+bool SoftMPEG2::setDecodeArgs(
ivd_video_decode_ip_t *ps_dec_ip,
ivd_video_decode_op_t *ps_dec_op,
OMX_BUFFERHEADERTYPE *inHeader,
@@ -474,7 +474,6 @@ void SoftMPEG2::setDecodeArgs(
size_t timeStampIx) {
size_t sizeY = outputBufferWidth() * outputBufferHeight();
size_t sizeUV;
- uint8_t *pBuf;
ps_dec_ip->u4_size = sizeof(ivd_video_decode_ip_t);
ps_dec_op->u4_size = sizeof(ivd_video_decode_op_t);
@@ -494,22 +493,28 @@ void SoftMPEG2::setDecodeArgs(
ps_dec_ip->u4_num_Bytes = 0;
}
+ sizeUV = sizeY / 4;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;
+ ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;
+
+ uint8_t *pBuf;
if (outHeader) {
+ if (outHeader->nAllocLen < sizeY + (sizeUV * 2)) {
+ android_errorWriteLog(0x534e4554, "27569635");
+ return false;
+ }
pBuf = outHeader->pBuffer;
} else {
+ // mFlushOutBuffer always has the right size.
pBuf = mFlushOutBuffer;
}
- sizeUV = sizeY / 4;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[0] = sizeY;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[1] = sizeUV;
- ps_dec_ip->s_out_buffer.u4_min_out_buf_size[2] = sizeUV;
-
ps_dec_ip->s_out_buffer.pu1_bufs[0] = pBuf;
ps_dec_ip->s_out_buffer.pu1_bufs[1] = pBuf + sizeY;
ps_dec_ip->s_out_buffer.pu1_bufs[2] = pBuf + sizeY + sizeUV;
ps_dec_ip->s_out_buffer.u4_num_bufs = 3;
- return;
+ return true;
}
void SoftMPEG2::onPortFlushCompleted(OMX_U32 portIndex) {
/* Once the output buffers are flushed, ignore any buffers that are held in decoder */
@@ -622,7 +627,11 @@ void SoftMPEG2::onQueueFilled(OMX_U32 portIndex) {
WORD32 timeDelay, timeTaken;
size_t sizeY, sizeUV;
- setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx);
+ if (!setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx)) {
+ ALOGE("Decoder arg setup failed");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ return;
+ }
// If input dump is enabled, then write to file
DUMP_TO_FILE(mInFile, s_dec_ip.pv_stream_buffer, s_dec_ip.u4_num_Bytes);
@@ -665,9 +674,9 @@ void SoftMPEG2::onQueueFilled(OMX_U32 portIndex) {
CHECK_EQ(reInitDecoder(), (status_t)OK);
- setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx);
-
- ivdec_api_function(mCodecCtx, (void *)&s_dec_ip, (void *)&s_dec_op);
+ if (setDecodeArgs(&s_dec_ip, &s_dec_op, inHeader, outHeader, timeStampIx)) {
+ ivdec_api_function(mCodecCtx, (void *)&s_dec_ip, (void *)&s_dec_op);
+ }
return;
}
diff --git a/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.h b/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.h
index a625e08..f48b70b 100644
--- a/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.h
+++ b/media/libstagefright/codecs/mpeg2dec/SoftMPEG2.h
@@ -117,7 +117,7 @@ private:
status_t resetPlugin();
status_t reInitDecoder();
- void setDecodeArgs(
+ bool setDecodeArgs(
ivd_video_decode_ip_t *ps_dec_ip,
ivd_video_decode_op_t *ps_dec_op,
OMX_BUFFERHEADERTYPE *inHeader,
diff --git a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp
index d9895f0..5c950c7 100644
--- a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp
+++ b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp
@@ -368,20 +368,24 @@ OMX_ERRORTYPE SoftVPXEncoder::internalGetParameter(OMX_INDEXTYPE index,
OMX_VIDEO_PARAM_BITRATETYPE *bitrate =
(OMX_VIDEO_PARAM_BITRATETYPE *)param;
- if (bitrate->nPortIndex != kOutputPortIndex) {
- return OMX_ErrorUnsupportedIndex;
- }
+ if (!isValidOMXParam(bitrate)) {
+ return OMX_ErrorBadParameter;
+ }
- bitrate->nTargetBitrate = mBitrate;
+ if (bitrate->nPortIndex != kOutputPortIndex) {
+ return OMX_ErrorUnsupportedIndex;
+ }
- if (mBitrateControlMode == VPX_VBR) {
- bitrate->eControlRate = OMX_Video_ControlRateVariable;
- } else if (mBitrateControlMode == VPX_CBR) {
- bitrate->eControlRate = OMX_Video_ControlRateConstant;
- } else {
- return OMX_ErrorUnsupportedSetting;
- }
- return OMX_ErrorNone;
+ bitrate->nTargetBitrate = mBitrate;
+
+ if (mBitrateControlMode == VPX_VBR) {
+ bitrate->eControlRate = OMX_Video_ControlRateVariable;
+ } else if (mBitrateControlMode == VPX_CBR) {
+ bitrate->eControlRate = OMX_Video_ControlRateConstant;
+ } else {
+ return OMX_ErrorUnsupportedSetting;
+ }
+ return OMX_ErrorNone;
}
// VP8 specific parameters that use extension headers
@@ -389,33 +393,41 @@ OMX_ERRORTYPE SoftVPXEncoder::internalGetParameter(OMX_INDEXTYPE index,
OMX_VIDEO_PARAM_VP8TYPE *vp8Params =
(OMX_VIDEO_PARAM_VP8TYPE *)param;
- if (vp8Params->nPortIndex != kOutputPortIndex) {
- return OMX_ErrorUnsupportedIndex;
- }
+ if (!isValidOMXParam(vp8Params)) {
+ return OMX_ErrorBadParameter;
+ }
- vp8Params->eProfile = OMX_VIDEO_VP8ProfileMain;
- vp8Params->eLevel = mLevel;
- vp8Params->nDCTPartitions = mDCTPartitions;
- vp8Params->bErrorResilientMode = mErrorResilience;
- return OMX_ErrorNone;
+ if (vp8Params->nPortIndex != kOutputPortIndex) {
+ return OMX_ErrorUnsupportedIndex;
+ }
+
+ vp8Params->eProfile = OMX_VIDEO_VP8ProfileMain;
+ vp8Params->eLevel = mLevel;
+ vp8Params->nDCTPartitions = mDCTPartitions;
+ vp8Params->bErrorResilientMode = mErrorResilience;
+ return OMX_ErrorNone;
}
case OMX_IndexParamVideoAndroidVp8Encoder: {
OMX_VIDEO_PARAM_ANDROID_VP8ENCODERTYPE *vp8AndroidParams =
(OMX_VIDEO_PARAM_ANDROID_VP8ENCODERTYPE *)param;
- if (vp8AndroidParams->nPortIndex != kOutputPortIndex) {
- return OMX_ErrorUnsupportedIndex;
- }
+ if (!isValidOMXParam(vp8AndroidParams)) {
+ return OMX_ErrorBadParameter;
+ }
- vp8AndroidParams->nKeyFrameInterval = mKeyFrameInterval;
- vp8AndroidParams->eTemporalPattern = mTemporalPatternType;
- vp8AndroidParams->nTemporalLayerCount = mTemporalLayers;
- vp8AndroidParams->nMinQuantizer = mMinQuantizer;
- vp8AndroidParams->nMaxQuantizer = mMaxQuantizer;
- memcpy(vp8AndroidParams->nTemporalLayerBitrateRatio,
- mTemporalLayerBitrateRatio, sizeof(mTemporalLayerBitrateRatio));
- return OMX_ErrorNone;
+ if (vp8AndroidParams->nPortIndex != kOutputPortIndex) {
+ return OMX_ErrorUnsupportedIndex;
+ }
+
+ vp8AndroidParams->nKeyFrameInterval = mKeyFrameInterval;
+ vp8AndroidParams->eTemporalPattern = mTemporalPatternType;
+ vp8AndroidParams->nTemporalLayerCount = mTemporalLayers;
+ vp8AndroidParams->nMinQuantizer = mMinQuantizer;
+ vp8AndroidParams->nMaxQuantizer = mMaxQuantizer;
+ memcpy(vp8AndroidParams->nTemporalLayerBitrateRatio,
+ mTemporalLayerBitrateRatio, sizeof(mTemporalLayerBitrateRatio));
+ return OMX_ErrorNone;
}
default:
@@ -430,17 +442,38 @@ OMX_ERRORTYPE SoftVPXEncoder::internalSetParameter(OMX_INDEXTYPE index,
const int32_t indexFull = index;
switch (indexFull) {
- case OMX_IndexParamVideoBitrate:
- return internalSetBitrateParams(
- (const OMX_VIDEO_PARAM_BITRATETYPE *)param);
+ case OMX_IndexParamVideoBitrate: {
+ const OMX_VIDEO_PARAM_BITRATETYPE *bitRate =
+ (const OMX_VIDEO_PARAM_BITRATETYPE*) param;
+
+ if (!isValidOMXParam(bitRate)) {
+ return OMX_ErrorBadParameter;
+ }
+
+ return internalSetBitrateParams(bitRate);
+ }
+
+ case OMX_IndexParamVideoVp8: {
+ const OMX_VIDEO_PARAM_VP8TYPE *vp8Params =
+ (const OMX_VIDEO_PARAM_VP8TYPE*) param;
+
+ if (!isValidOMXParam(vp8Params)) {
+ return OMX_ErrorBadParameter;
+ }
+
+ return internalSetVp8Params(vp8Params);
+ }
- case OMX_IndexParamVideoVp8:
- return internalSetVp8Params(
- (const OMX_VIDEO_PARAM_VP8TYPE *)param);
+ case OMX_IndexParamVideoAndroidVp8Encoder: {
+ const OMX_VIDEO_PARAM_ANDROID_VP8ENCODERTYPE *vp8AndroidParams =
+ (const OMX_VIDEO_PARAM_ANDROID_VP8ENCODERTYPE*) param;
+
+ if (!isValidOMXParam(vp8AndroidParams)) {
+ return OMX_ErrorBadParameter;
+ }
- case OMX_IndexParamVideoAndroidVp8Encoder:
- return internalSetAndroidVp8Params(
- (const OMX_VIDEO_PARAM_ANDROID_VP8ENCODERTYPE *)param);
+ return internalSetAndroidVp8Params(vp8AndroidParams);
+ }
default:
return SoftVideoEncoderOMXComponent::internalSetParameter(index, param);
@@ -455,6 +488,10 @@ OMX_ERRORTYPE SoftVPXEncoder::setConfig(
OMX_CONFIG_INTRAREFRESHVOPTYPE *params =
(OMX_CONFIG_INTRAREFRESHVOPTYPE *)_params;
+ if (!isValidOMXParam(params)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (params->nPortIndex != kOutputPortIndex) {
return OMX_ErrorBadPortIndex;
}
@@ -468,6 +505,10 @@ OMX_ERRORTYPE SoftVPXEncoder::setConfig(
OMX_VIDEO_CONFIG_BITRATETYPE *params =
(OMX_VIDEO_CONFIG_BITRATETYPE *)_params;
+ if (!isValidOMXParam(params)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (params->nPortIndex != kOutputPortIndex) {
return OMX_ErrorBadPortIndex;
}
diff --git a/media/libstagefright/codecs/on2/h264dec/SoftAVC.cpp b/media/libstagefright/codecs/on2/h264dec/SoftAVC.cpp
index 6b8b395..2f61d12 100644
--- a/media/libstagefright/codecs/on2/h264dec/SoftAVC.cpp
+++ b/media/libstagefright/codecs/on2/h264dec/SoftAVC.cpp
@@ -202,7 +202,12 @@ void SoftAVC::onQueueFilled(OMX_U32 /* portIndex */) {
}
if (mFirstPicture && !outQueue.empty()) {
- drainOneOutputBuffer(mFirstPictureId, mFirstPicture);
+ if (!drainOneOutputBuffer(mFirstPictureId, mFirstPicture)) {
+ ALOGE("Drain failed");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
delete[] mFirstPicture;
mFirstPicture = NULL;
mFirstPictureId = -1;
@@ -242,15 +247,20 @@ void SoftAVC::saveFirstOutputBuffer(int32_t picId, uint8_t *data) {
memcpy(mFirstPicture, data, pictureSize);
}
-void SoftAVC::drainOneOutputBuffer(int32_t picId, uint8_t* data) {
+bool SoftAVC::drainOneOutputBuffer(int32_t picId, uint8_t* data) {
List<BufferInfo *> &outQueue = getPortQueue(kOutputPortIndex);
BufferInfo *outInfo = *outQueue.begin();
- outQueue.erase(outQueue.begin());
OMX_BUFFERHEADERTYPE *outHeader = outInfo->mHeader;
+ OMX_U32 frameSize = mWidth * mHeight * 3 / 2;
+ if (outHeader->nAllocLen - outHeader->nOffset < frameSize) {
+ android_errorWriteLog(0x534e4554, "27833616");
+ return false;
+ }
+ outQueue.erase(outQueue.begin());
OMX_BUFFERHEADERTYPE *header = mPicToHeaderMap.valueFor(picId);
outHeader->nTimeStamp = header->nTimeStamp;
outHeader->nFlags = header->nFlags;
- outHeader->nFilledLen = mWidth * mHeight * 3 / 2;
+ outHeader->nFilledLen = frameSize;
uint8_t *dst = outHeader->pBuffer + outHeader->nOffset;
const uint8_t *srcY = data;
@@ -265,6 +275,7 @@ void SoftAVC::drainOneOutputBuffer(int32_t picId, uint8_t* data) {
delete header;
outInfo->mOwnedByUs = false;
notifyFillBufferDone(outHeader);
+ return true;
}
void SoftAVC::drainAllOutputBuffers(bool eos) {
@@ -277,7 +288,12 @@ void SoftAVC::drainAllOutputBuffers(bool eos) {
mHandle, &decodedPicture, eos /* flush */)) {
int32_t picId = decodedPicture.picId;
uint8_t *data = (uint8_t *) decodedPicture.pOutputPicture;
- drainOneOutputBuffer(picId, data);
+ if (!drainOneOutputBuffer(picId, data)) {
+ ALOGE("Drain failed");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
}
}
diff --git a/media/libstagefright/codecs/on2/h264dec/SoftAVC.h b/media/libstagefright/codecs/on2/h264dec/SoftAVC.h
index 069107d..b8c1807 100644
--- a/media/libstagefright/codecs/on2/h264dec/SoftAVC.h
+++ b/media/libstagefright/codecs/on2/h264dec/SoftAVC.h
@@ -71,7 +71,7 @@ private:
status_t initDecoder();
void drainAllOutputBuffers(bool eos);
- void drainOneOutputBuffer(int32_t picId, uint8_t *data);
+ bool drainOneOutputBuffer(int32_t picId, uint8_t *data);
void saveFirstOutputBuffer(int32_t pidId, uint8_t *data);
CropSettingsMode handleCropParams(const H264SwDecInfo& decInfo);
diff --git a/media/libstagefright/codecs/on2/h264dec/inc/H264SwDecApi.h b/media/libstagefright/codecs/on2/h264dec/inc/H264SwDecApi.h
index fe112bc..9814e73 100644
--- a/media/libstagefright/codecs/on2/h264dec/inc/H264SwDecApi.h
+++ b/media/libstagefright/codecs/on2/h264dec/inc/H264SwDecApi.h
@@ -161,7 +161,7 @@ extern "C"
void H264SwDecTrace(char *);
/* function prototype for memory allocation */
- void* H264SwDecMalloc(u32 size);
+ void* H264SwDecMalloc(u32 size, u32 num);
/* function prototype for memory free */
void H264SwDecFree(void *ptr);
diff --git a/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c b/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c
index dcf2ef6..55c0065 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c
+++ b/media/libstagefright/codecs/on2/h264dec/source/DecTestBench.c
@@ -700,18 +700,21 @@ void H264SwDecTrace(char *string)
library function malloc for allocation of memory.
------------------------------------------------------------------------------*/
-void* H264SwDecMalloc(u32 size)
+void* H264SwDecMalloc(u32 size, u32 num)
{
+ if (size > UINT32_MAX / num) {
+ return NULL;
+ }
#if defined(CHECK_MEMORY_USAGE)
/* Note that if the decoder has to free and reallocate some of the buffers
* the total value will be invalid */
static u32 numBytes = 0;
- numBytes += size;
+ numBytes += size * num;
DEBUG(("Allocated %d bytes, total %d\n", size, numBytes));
#endif
- return malloc(size);
+ return malloc(size * num);
}
/*------------------------------------------------------------------------------
diff --git a/media/libstagefright/codecs/on2/h264dec/source/EvaluationTestBench.c b/media/libstagefright/codecs/on2/h264dec/source/EvaluationTestBench.c
index aadc75f..e756a1f 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/EvaluationTestBench.c
+++ b/media/libstagefright/codecs/on2/h264dec/source/EvaluationTestBench.c
@@ -85,7 +85,7 @@ int main(int argc, char **argv)
rewind(finput);
/* allocate memory for stream buffer, exit if unsuccessful */
- byteStrm = byteStrmStart = (u8 *)H264SwDecMalloc(sizeof(u8)*strmLen);
+ byteStrm = byteStrmStart = (u8 *)H264SwDecMalloc(sizeof(u8), strmLen);
if (byteStrm == NULL)
{
printf("UNABLE TO ALLOCATE MEMORY\n");
@@ -298,9 +298,12 @@ void H264SwDecTrace(char *string)
library function malloc for allocation of memory.
------------------------------------------------------------------------------*/
-void* H264SwDecMalloc(u32 size)
+void* H264SwDecMalloc(u32 size, u32 num)
{
- return malloc(size);
+ if (size > UINT32_MAX / num) {
+ return NULL;
+ }
+ return malloc(size * num);
}
/*------------------------------------------------------------------------------
diff --git a/media/libstagefright/codecs/on2/h264dec/source/H264SwDecApi.c b/media/libstagefright/codecs/on2/h264dec/source/H264SwDecApi.c
index a073dcb..f820dfd 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/H264SwDecApi.c
+++ b/media/libstagefright/codecs/on2/h264dec/source/H264SwDecApi.c
@@ -35,6 +35,8 @@
/*------------------------------------------------------------------------------
1. Include headers
------------------------------------------------------------------------------*/
+#include <log/log.h>
+
#include <stdlib.h>
#include <string.h>
#include "basetype.h"
@@ -79,8 +81,13 @@ void H264SwDecTrace(char *string) {
UNUSED(string);
}
-void* H264SwDecMalloc(u32 size) {
- return malloc(size);
+void* H264SwDecMalloc(u32 size, u32 num) {
+ if (size > UINT32_MAX / num) {
+ ALOGE("can't allocate %u * %u bytes", size, num);
+ android_errorWriteLog(0x534e4554, "27855419");
+ return NULL;
+ }
+ return malloc(size * num);
}
void H264SwDecFree(void *ptr) {
@@ -144,7 +151,7 @@ H264SwDecRet H264SwDecInit(H264SwDecInst *decInst, u32 noOutputReordering)
return(H264SWDEC_PARAM_ERR);
}
- pDecCont = (decContainer_t *)H264SwDecMalloc(sizeof(decContainer_t));
+ pDecCont = (decContainer_t *)H264SwDecMalloc(sizeof(decContainer_t), 1);
if (pDecCont == NULL)
{
diff --git a/media/libstagefright/codecs/on2/h264dec/source/TestBenchMultipleInstance.c b/media/libstagefright/codecs/on2/h264dec/source/TestBenchMultipleInstance.c
index 42170d3..9a386bb 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/TestBenchMultipleInstance.c
+++ b/media/libstagefright/codecs/on2/h264dec/source/TestBenchMultipleInstance.c
@@ -413,9 +413,12 @@ void H264SwDecTrace(char *string)
Function name: H264SwDecmalloc
------------------------------------------------------------------------------*/
-void* H264SwDecMalloc(u32 size)
+void* H264SwDecMalloc(u32 size, u32 num)
{
- return malloc(size);
+ if (size > UINT32_MAX / num) {
+ return NULL;
+ }
+ return malloc(size * num);
}
/*------------------------------------------------------------------------------
diff --git a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_decoder.c b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_decoder.c
index a816871..0ac480f 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_decoder.c
+++ b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_decoder.c
@@ -101,7 +101,7 @@ u32 h264bsdInit(storage_t *pStorage, u32 noOutputReordering)
* specific NEON optimized "memset" for clearing the structure */
size = (sizeof(macroblockLayer_t) + 63) & ~0x3F;
- pStorage->mbLayer = (macroblockLayer_t*)H264SwDecMalloc(size);
+ pStorage->mbLayer = (macroblockLayer_t*)H264SwDecMalloc(size, 1);
if (!pStorage->mbLayer)
return HANTRO_NOK;
diff --git a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.h b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.h
index 216ad04..9f0eb7d 100644
--- a/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.h
+++ b/media/libstagefright/codecs/on2/h264dec/source/h264bsd_util.h
@@ -141,7 +141,7 @@
/* macro to allocate memory */
#define ALLOCATE(ptr, count, type) \
{ \
- (ptr) = H264SwDecMalloc((count) * sizeof(type)); \
+ (ptr) = H264SwDecMalloc(sizeof(type), (count)); \
}
/* macro to free allocated memory */
diff --git a/media/libstagefright/codecs/opus/dec/SoftOpus.cpp b/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
index cb10bce..2e44ed7 100644
--- a/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
+++ b/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
@@ -134,6 +134,10 @@ OMX_ERRORTYPE SoftOpus::internalGetParameter(
OMX_AUDIO_PARAM_ANDROID_OPUSTYPE *opusParams =
(OMX_AUDIO_PARAM_ANDROID_OPUSTYPE *)params;
+ if (!isValidOMXParam(opusParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (opusParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -156,6 +160,10 @@ OMX_ERRORTYPE SoftOpus::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -191,6 +199,10 @@ OMX_ERRORTYPE SoftOpus::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.opus",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -205,6 +217,10 @@ OMX_ERRORTYPE SoftOpus::internalSetParameter(
const OMX_AUDIO_PARAM_ANDROID_OPUSTYPE *opusParams =
(const OMX_AUDIO_PARAM_ANDROID_OPUSTYPE *)params;
+ if (!isValidOMXParam(opusParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (opusParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -442,12 +458,17 @@ void SoftOpus::onQueueFilled(OMX_U32 portIndex) {
const uint8_t *data = inHeader->pBuffer + inHeader->nOffset;
const uint32_t size = inHeader->nFilledLen;
+ size_t frameSize = kMaxOpusOutputPacketSizeSamples;
+ if (frameSize > outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels) {
+ frameSize = outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels;
+ android_errorWriteLog(0x534e4554, "27833616");
+ }
int numFrames = opus_multistream_decode(mDecoder,
data,
size,
(int16_t *)outHeader->pBuffer,
- kMaxOpusOutputPacketSizeSamples,
+ frameSize,
0);
if (numFrames < 0) {
ALOGE("opus_multistream_decode returned %d", numFrames);
diff --git a/media/libstagefright/codecs/raw/SoftRaw.cpp b/media/libstagefright/codecs/raw/SoftRaw.cpp
index 0d80098..f90c1b3 100644
--- a/media/libstagefright/codecs/raw/SoftRaw.cpp
+++ b/media/libstagefright/codecs/raw/SoftRaw.cpp
@@ -104,6 +104,10 @@ OMX_ERRORTYPE SoftRaw::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0 && pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -135,6 +139,10 @@ OMX_ERRORTYPE SoftRaw::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.raw",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -149,6 +157,10 @@ OMX_ERRORTYPE SoftRaw::internalSetParameter(
const OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 08200c1..7209796 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -131,6 +131,10 @@ OMX_ERRORTYPE SoftVorbis::internalGetParameter(
OMX_AUDIO_PARAM_VORBISTYPE *vorbisParams =
(OMX_AUDIO_PARAM_VORBISTYPE *)params;
+ if (!isValidOMXParam(vorbisParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (vorbisParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -162,6 +166,10 @@ OMX_ERRORTYPE SoftVorbis::internalGetParameter(
OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
(OMX_AUDIO_PARAM_PCMMODETYPE *)params;
+ if (!isValidOMXParam(pcmParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (pcmParams->nPortIndex != 1) {
return OMX_ErrorUndefined;
}
@@ -198,6 +206,10 @@ OMX_ERRORTYPE SoftVorbis::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
"audio_decoder.vorbis",
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -212,6 +224,10 @@ OMX_ERRORTYPE SoftVorbis::internalSetParameter(
const OMX_AUDIO_PARAM_VORBISTYPE *vorbisParams =
(const OMX_AUDIO_PARAM_VORBISTYPE *)params;
+ if (!isValidOMXParam(vorbisParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (vorbisParams->nPortIndex != 0) {
return OMX_ErrorUndefined;
}
@@ -269,6 +285,12 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
const uint8_t *data = header->pBuffer + header->nOffset;
size_t size = header->nFilledLen;
+ if (size < 7) {
+ ALOGE("Too small input buffer: %zu bytes", size);
+ android_errorWriteLog(0x534e4554, "27833616");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ return;
+ }
ogg_buffer buf;
ogg_reference ref;
@@ -374,9 +396,14 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
ALOGW("vorbis_dsp_synthesis returned %d", err);
#endif
} else {
+ size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;
+ if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {
+ numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);
+ android_errorWriteLog(0x534e4554, "27833616");
+ }
numFrames = vorbis_dsp_pcmout(
mState, (int16_t *)outHeader->pBuffer,
- (kMaxNumSamplesPerBuffer / mVi->channels));
+ (numSamplesPerBuffer / mVi->channels));
if (numFrames < 0) {
ALOGE("vorbis_dsp_pcmout returned %d", numFrames);
diff --git a/media/libstagefright/include/SampleTable.h b/media/libstagefright/include/SampleTable.h
index 460492b..465f37c 100644
--- a/media/libstagefright/include/SampleTable.h
+++ b/media/libstagefright/include/SampleTable.h
@@ -24,6 +24,7 @@
#include <media/stagefright/MediaErrors.h>
#include <utils/RefBase.h>
#include <utils/threads.h>
+#include <utils/Vector.h>
namespace android {
@@ -110,8 +111,9 @@ private:
uint32_t mDefaultSampleSize;
uint32_t mNumSampleSizes;
+ bool mHasTimeToSample;
uint32_t mTimeToSampleCount;
- uint32_t *mTimeToSample;
+ Vector<uint32_t> mTimeToSample;
struct SampleTimeEntry {
uint32_t mSampleIndex;
diff --git a/media/libstagefright/include/SoftOMXComponent.h b/media/libstagefright/include/SoftOMXComponent.h
index a808611..3ab6f88 100644
--- a/media/libstagefright/include/SoftOMXComponent.h
+++ b/media/libstagefright/include/SoftOMXComponent.h
@@ -168,6 +168,22 @@ private:
DISALLOW_EVIL_CONSTRUCTORS(SoftOMXComponent);
};
+template<typename T>
+bool isValidOMXParam(T *a) {
+ static_assert(offsetof(typeof(*a), nSize) == 0, "nSize not at offset 0");
+ static_assert(std::is_same< decltype(a->nSize), OMX_U32>::value, "nSize has wrong type");
+ static_assert(offsetof(typeof(*a), nVersion) == 4, "nVersion not at offset 4");
+ static_assert(std::is_same< decltype(a->nVersion), OMX_VERSIONTYPE>::value,
+ "nVersion has wrong type");
+
+ if (a->nSize < sizeof(*a)) {
+ ALOGE("b/27207275: need %zu, got %u", sizeof(*a), a->nSize);
+ android_errorWriteLog(0x534e4554, "27207275");
+ return false;
+ }
+ return true;
+}
+
} // namespace android
#endif // SOFT_OMX_COMPONENT_H_
diff --git a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
index 1fd0641..42b6726 100644
--- a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
+++ b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
@@ -125,6 +125,10 @@ OMX_ERRORTYPE SimpleSoftOMXComponent::internalGetParameter(
OMX_PARAM_PORTDEFINITIONTYPE *defParams =
(OMX_PARAM_PORTDEFINITIONTYPE *)params;
+ if (!isValidOMXParam(defParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (defParams->nPortIndex >= mPorts.size()
|| defParams->nSize
!= sizeof(OMX_PARAM_PORTDEFINITIONTYPE)) {
@@ -152,6 +156,10 @@ OMX_ERRORTYPE SimpleSoftOMXComponent::internalSetParameter(
OMX_PARAM_PORTDEFINITIONTYPE *defParams =
(OMX_PARAM_PORTDEFINITIONTYPE *)params;
+ if (!isValidOMXParam(defParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (defParams->nPortIndex >= mPorts.size()) {
return OMX_ErrorBadPortIndex;
}
diff --git a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
index 4ce165b..19dde83 100644
--- a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
+++ b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
@@ -264,6 +264,10 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalGetParameter(
OMX_VIDEO_PARAM_PORTFORMATTYPE *formatParams =
(OMX_VIDEO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > kMaxPortIndex) {
return OMX_ErrorBadPortIndex;
}
@@ -292,6 +296,10 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalGetParameter(
OMX_VIDEO_PARAM_PROFILELEVELTYPE *profileLevel =
(OMX_VIDEO_PARAM_PROFILELEVELTYPE *) params;
+ if (!isValidOMXParam(profileLevel)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (profileLevel->nPortIndex != kInputPortIndex) {
ALOGE("Invalid port index: %" PRIu32, profileLevel->nPortIndex);
return OMX_ErrorUnsupportedIndex;
@@ -322,6 +330,10 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalSetParameter(
const OMX_PARAM_COMPONENTROLETYPE *roleParams =
(const OMX_PARAM_COMPONENTROLETYPE *)params;
+ if (!isValidOMXParam(roleParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (strncmp((const char *)roleParams->cRole,
mComponentRole,
OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -336,6 +348,10 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalSetParameter(
OMX_VIDEO_PARAM_PORTFORMATTYPE *formatParams =
(OMX_VIDEO_PARAM_PORTFORMATTYPE *)params;
+ if (!isValidOMXParam(formatParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (formatParams->nPortIndex > kMaxPortIndex) {
return OMX_ErrorBadPortIndex;
}
@@ -363,6 +379,11 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalSetParameter(
{
const PrepareForAdaptivePlaybackParams* adaptivePlaybackParams =
(const PrepareForAdaptivePlaybackParams *)params;
+
+ if (!isValidOMXParam(adaptivePlaybackParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
mIsAdaptive = adaptivePlaybackParams->bEnable;
if (mIsAdaptive) {
mAdaptiveMaxWidth = adaptivePlaybackParams->nMaxFrameWidth;
@@ -381,6 +402,11 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::internalSetParameter(
{
OMX_PARAM_PORTDEFINITIONTYPE *newParams =
(OMX_PARAM_PORTDEFINITIONTYPE *)params;
+
+ if (!isValidOMXParam(newParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
OMX_VIDEO_PORTDEFINITIONTYPE *video_def = &newParams->format.video;
OMX_PARAM_PORTDEFINITIONTYPE *def = &editPortInfo(newParams->nPortIndex)->mDef;
@@ -421,6 +447,10 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::getConfig(
{
OMX_CONFIG_RECTTYPE *rectParams = (OMX_CONFIG_RECTTYPE *)params;
+ if (!isValidOMXParam(rectParams)) {
+ return OMX_ErrorBadParameter;
+ }
+
if (rectParams->nPortIndex != kOutputPortIndex) {
return OMX_ErrorUndefined;
}