SoftVorbis: memory access check

Check for valid input buffer header before
reading from it. This seems to be manifested
only when memory map of an input buffer sent from
a remote process fails in mediaserver context.

CRs-Fixed: 916568

Change-Id: I4ee16e7104c2d8bf579f80201864009e51cd1b25

2 files changed, 15 insertions, 1 deletions

diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 3dc549e..08200c1 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -56,7 +56,8 @@ SoftVorbis::SoftVorbis(
       mNumFramesLeftOnPage(-1),
       mSawInputEos(false),
       mSignalledOutputEos(false),
-      mOutputPortSettingsChange(NONE) {
+      mOutputPortSettingsChange(NONE),
+      mSignalledError(false) {
     initPorts();
     CHECK_EQ(initDecoder(), (status_t)OK);
 }
@@ -251,10 +252,21 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
         return;
     }
 
+    if (mSignalledError) {
+        return;
+    }
+
     if (portIndex == 0 && mInputBufferCount < 2) {
         BufferInfo *info = *inQueue.begin();
         OMX_BUFFERHEADERTYPE *header = info->mHeader;
 
+        if (!header || !header->pBuffer) {
+            ALOGE("b/25727575 has happened. report error");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         const uint8_t *data = header->pBuffer + header->nOffset;
         size_t size = header->nFilledLen;
 
diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h
index 1d00816..7decc5a 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h
@@ -68,6 +68,8 @@ private:
         AWAITING_ENABLED
     } mOutputPortSettingsChange;
 
+    bool mSignalledError;
+
     void initPorts();
     status_t initDecoder();
     bool isConfigured() const;