diff options
author | Jessica Wagantall <jwagantall@cyngn.com> | 2016-09-07 14:24:46 -0700 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-09-07 14:24:46 -0700 |
commit | d9a8909b45b516f54460c2bb13af31a9639fe703 (patch) | |
tree | 9fa13ec5ed0a2fc8f5ed4fd89dd29c0cb445cd42 /media/libstagefright/codecs/on2/dec/SoftVPX.cpp | |
parent | bdb54da9baf8349a1f030064c3af4ff7318f4771 (diff) | |
parent | 6679b5088f36693f5708dcaedd0c9ab7c66df27c (diff) | |
download | frameworks_av-d9a8909b45b516f54460c2bb13af31a9639fe703.zip frameworks_av-d9a8909b45b516f54460c2bb13af31a9639fe703.tar.gz frameworks_av-d9a8909b45b516f54460c2bb13af31a9639fe703.tar.bz2 |
Merge tag 'android-6.0.1_r66' into HEAD
Android 6.0.1 release 66
Change-Id: I1d3eb6b66b7482149fe93647c278065fa46dc518
Diffstat (limited to 'media/libstagefright/codecs/on2/dec/SoftVPX.cpp')
-rw-r--r-- | media/libstagefright/codecs/on2/dec/SoftVPX.cpp | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp index 76e7534..444a7fc 100644 --- a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp +++ b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp @@ -148,7 +148,7 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por outHeader->nFlags = 0; outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2; outHeader->nTimeStamp = *(OMX_TICKS *)mImg->user_priv; - if (outHeader->nAllocLen >= outHeader->nFilledLen) { + if (outputBufferSafe(outHeader)) { uint8_t *dst = outHeader->pBuffer; const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y]; const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U]; @@ -158,8 +158,6 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por size_t srcVStride = mImg->stride[VPX_PLANE_V]; copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride); } else { - ALOGE("b/27597103, buffer too small"); - android_errorWriteLog(0x534e4554, "27597103"); outHeader->nFilledLen = 0; } @@ -189,6 +187,25 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por return true; } +bool SoftVPX::outputBufferSafe(OMX_BUFFERHEADERTYPE *outHeader) { + uint32_t width = outputBufferWidth(); + uint32_t height = outputBufferHeight(); + uint64_t nFilledLen = width; + nFilledLen *= height; + if (nFilledLen > UINT32_MAX / 3) { + ALOGE("b/29421675, nFilledLen overflow %llu w %u h %u", + (unsigned long long)nFilledLen, width, height); + android_errorWriteLog(0x534e4554, "29421675"); + return false; + } else if (outHeader->nAllocLen < outHeader->nFilledLen) { + ALOGE("b/27597103, buffer too small"); + android_errorWriteLog(0x534e4554, "27597103"); + return false; + } + + return true; +} + void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) { if (mOutputPortSettingsChange != NONE || mEOSStatus == OUTPUT_FRAMES_FLUSHED) { return; |