diff options
| author | Wei Jia <wjia@google.com> | 2015-08-20 01:15:56 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-20 01:15:56 +0000 |
| commit | 96a09849ee1729f6aa69da9e60f6b4556c898057 (patch) | |
| tree | 48620221e48235d305ba3fef1f892cd5c8dee959 | |
| parent | d6d7296d01e7b72f7212837e2158e4c77d145fbe (diff) | |
| parent | 50b600d66eb87bccf8010f30bece4e1f135322d1 (diff) | |
| download | frameworks_av-96a09849ee1729f6aa69da9e60f6b4556c898057.zip frameworks_av-96a09849ee1729f6aa69da9e60f6b4556c898057.tar.gz frameworks_av-96a09849ee1729f6aa69da9e60f6b4556c898057.tar.bz2 | |
am 50b600d6: am ab33de61: am 78df80c2: am 65842db0: Merge commit \'b46eb8d9\' into HEAD
* commit '50b600d66eb87bccf8010f30bece4e1f135322d1':
SoftAVCEnc: check requested memory size before allocation.
| -rw-r--r-- | media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp b/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp index 928a74f..101ba75 100644 --- a/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp +++ b/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp @@ -244,6 +244,10 @@ OMX_ERRORTYPE SoftAVCEncoder::initEncParams() { if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) { // Color conversion is needed. free(mInputFrameData); + if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("Buffer size is too big."); + return OMX_ErrorUndefined; + } mInputFrameData = (uint8_t *) malloc((mWidth * mHeight * 3 ) >> 1); CHECK(mInputFrameData != NULL); @@ -264,6 +268,10 @@ OMX_ERRORTYPE SoftAVCEncoder::initEncParams() { int32_t nMacroBlocks = divUp(mWidth, 16) * divUp(mHeight, 16); CHECK(mSliceGroup == NULL); + if (nMacroBlocks > SIZE_MAX / sizeof(uint32_t)) { + ALOGE("requested memory size is too big."); + return OMX_ErrorUndefined; + } mSliceGroup = (uint32_t *) malloc(sizeof(uint32_t) * nMacroBlocks); CHECK(mSliceGroup != NULL); for (int ii = 0, idx = 0; ii < nMacroBlocks; ++ii) { |