Merge tag 'android-6.0.1_r46' into HEAD

Android 6.0.1 release 46

Change-Id: I4fcabf5775aebd2cb8dc0e352d1b1460d3214573

1 files changed, 28 insertions, 1 deletions

diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 08200c1..7209796 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -131,6 +131,10 @@ OMX_ERRORTYPE SoftVorbis::internalGetParameter(
             OMX_AUDIO_PARAM_VORBISTYPE *vorbisParams =
                 (OMX_AUDIO_PARAM_VORBISTYPE *)params;
 
+            if (!isValidOMXParam(vorbisParams)) {
+                return OMX_ErrorBadParameter;
+            }
+
             if (vorbisParams->nPortIndex != 0) {
                 return OMX_ErrorUndefined;
             }
@@ -162,6 +166,10 @@ OMX_ERRORTYPE SoftVorbis::internalGetParameter(
             OMX_AUDIO_PARAM_PCMMODETYPE *pcmParams =
                 (OMX_AUDIO_PARAM_PCMMODETYPE *)params;
 
+            if (!isValidOMXParam(pcmParams)) {
+                return OMX_ErrorBadParameter;
+            }
+
             if (pcmParams->nPortIndex != 1) {
                 return OMX_ErrorUndefined;
             }
@@ -198,6 +206,10 @@ OMX_ERRORTYPE SoftVorbis::internalSetParameter(
             const OMX_PARAM_COMPONENTROLETYPE *roleParams =
                 (const OMX_PARAM_COMPONENTROLETYPE *)params;
 
+            if (!isValidOMXParam(roleParams)) {
+                return OMX_ErrorBadParameter;
+            }
+
             if (strncmp((const char *)roleParams->cRole,
                         "audio_decoder.vorbis",
                         OMX_MAX_STRINGNAME_SIZE - 1)) {
@@ -212,6 +224,10 @@ OMX_ERRORTYPE SoftVorbis::internalSetParameter(
             const OMX_AUDIO_PARAM_VORBISTYPE *vorbisParams =
                 (const OMX_AUDIO_PARAM_VORBISTYPE *)params;
 
+            if (!isValidOMXParam(vorbisParams)) {
+                return OMX_ErrorBadParameter;
+            }
+
             if (vorbisParams->nPortIndex != 0) {
                 return OMX_ErrorUndefined;
             }
@@ -269,6 +285,12 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
 
         const uint8_t *data = header->pBuffer + header->nOffset;
         size_t size = header->nFilledLen;
+        if (size < 7) {
+            ALOGE("Too small input buffer: %zu bytes", size);
+            android_errorWriteLog(0x534e4554, "27833616");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            return;
+        }
 
         ogg_buffer buf;
         ogg_reference ref;
@@ -374,9 +396,14 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
             ALOGW("vorbis_dsp_synthesis returned %d", err);
 #endif
         } else {
+            size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;
+            if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {
+                numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);
+                android_errorWriteLog(0x534e4554, "27833616");
+            }
             numFrames = vorbis_dsp_pcmout(
                     mState, (int16_t *)outHeader->pBuffer,
-                    (kMaxNumSamplesPerBuffer / mVi->channels));
+                    (numSamplesPerBuffer / mVi->channels));
 
             if (numFrames < 0) {
                 ALOGE("vorbis_dsp_pcmout returned %d", numFrames);