diff options
author | Wei Jia <wjia@google.com> | 2015-08-18 00:53:07 +0000 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-18 00:53:07 +0000 |
commit | b46eb8d9f8bff2e6ddec1902acc9d2ad65147d68 (patch) | |
tree | 6af463d6368a2031a12873f8795d138160bf6a1d | |
parent | 88aa97ea87b7e4f7b4f82df3500754e03205ef60 (diff) | |
parent | 479b4de0d267eb7d4c419f4da0069186a952ad17 (diff) | |
download | frameworks_av-b46eb8d9f8bff2e6ddec1902acc9d2ad65147d68.zip frameworks_av-b46eb8d9f8bff2e6ddec1902acc9d2ad65147d68.tar.gz frameworks_av-b46eb8d9f8bff2e6ddec1902acc9d2ad65147d68.tar.bz2 |
am 479b4de0: SoftAVCEnc: check requested memory size before allocation.
* commit '479b4de0d267eb7d4c419f4da0069186a952ad17':
SoftAVCEnc: check requested memory size before allocation.
-rw-r--r-- | media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp b/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp index 4a21a3e..4cdf8c4 100644 --- a/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp +++ b/media/libstagefright/codecs/avc/enc/SoftAVCEncoder.cpp @@ -257,6 +257,10 @@ OMX_ERRORTYPE SoftAVCEncoder::initEncParams() { if (mVideoColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) { // Color conversion is needed. CHECK(mInputFrameData == NULL); + if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("Buffer size is too big."); + return OMX_ErrorUndefined; + } mInputFrameData = (uint8_t *) malloc((mVideoWidth * mVideoHeight * 3 ) >> 1); CHECK(mInputFrameData != NULL); @@ -278,6 +282,10 @@ OMX_ERRORTYPE SoftAVCEncoder::initEncParams() { int32_t nMacroBlocks = ((((mVideoWidth + 15) >> 4) << 4) * (((mVideoHeight + 15) >> 4) << 4)) >> 8; CHECK(mSliceGroup == NULL); + if (nMacroBlocks > SIZE_MAX / sizeof(uint32_t)) { + ALOGE("requested memory size is too big."); + return OMX_ErrorUndefined; + } mSliceGroup = (uint32_t *) malloc(sizeof(uint32_t) * nMacroBlocks); CHECK(mSliceGroup != NULL); for (int ii = 0, idx = 0; ii < nMacroBlocks; ++ii) { @@ -698,6 +706,10 @@ OMX_ERRORTYPE SoftAVCEncoder::internalSetParameter( if (mStoreMetaDataInBuffers) { mVideoColorFormat == OMX_COLOR_FormatYUV420SemiPlanar; if (mInputFrameData == NULL) { + if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("Buffer size is too big."); + return OMX_ErrorUndefined; + } mInputFrameData = (uint8_t *) malloc((mVideoWidth * mVideoHeight * 3 ) >> 1); } |