diff options
| author | Wonsik Kim <wonsik@google.com> | 2016-03-20 10:44:44 +0900 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-04-21 19:09:55 -0700 |
| commit | d2f47191538837e796e2b10c1ff7e1ee35f6e0ab (patch) | |
| tree | af1b0470da255756c44fa2b1c790ee2bbd84bf4d /media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp | |
| parent | 4e32001e4196f39ddd0b86686ae0231c8f5ed944 (diff) | |
| download | frameworks_av-d2f47191538837e796e2b10c1ff7e1ee35f6e0ab.zip frameworks_av-d2f47191538837e796e2b10c1ff7e1ee35f6e0ab.tar.gz frameworks_av-d2f47191538837e796e2b10c1ff7e1ee35f6e0ab.tar.bz2 | |
codecs: check OMX buffer size before use in (h263|h264)dec
Bug: 27833616
Change-Id: I0fd599b3da431425d89236ffdd9df423c11947c0
Diffstat (limited to 'media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp')
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp b/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp index 0c1a149..bb59ae4 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp @@ -229,6 +229,14 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { int32_t bufferSize = inHeader->nFilledLen; int32_t tmp = bufferSize; + OMX_U32 frameSize = (mWidth * mHeight * 3) / 2; + if (outHeader->nAllocLen < frameSize) { + android_errorWriteLog(0x534e4554, "27833616"); + ALOGE("Insufficient output buffer size"); + notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL); + mSignalledError = true; + return; + } // The PV decoder is lying to us, sometimes it'll claim to only have // consumed a subset of the buffer when it clearly consumed all of it. // ignore whatever it says... @@ -272,7 +280,7 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { ++mInputBufferCount; outHeader->nOffset = 0; - outHeader->nFilledLen = (mWidth * mHeight * 3) / 2; + outHeader->nFilledLen = frameSize; List<BufferInfo *>::iterator it = outQueue.begin(); while ((*it)->mHeader != outHeader) { |