diff options
| author | Wei Jia <wjia@google.com> | 2015-11-20 10:34:35 -0800 |
|---|---|---|
| committer | Wei Jia <wjia@google.com> | 2015-12-03 17:40:16 +0000 |
| commit | 0462975291796e414891e04bcec9da993914e458 (patch) | |
| tree | 27e9f317a6af761a4026418d9decb059a4218b3f /media/libstagefright | |
| parent | 09c291c838bc74bb7c10c22f7232abb946cad8ff (diff) | |
| download | frameworks_av-0462975291796e414891e04bcec9da993914e458.zip frameworks_av-0462975291796e414891e04bcec9da993914e458.tar.gz frameworks_av-0462975291796e414891e04bcec9da993914e458.tar.bz2 | |
DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
Bug: 25812794
Change-Id: I96dc74734380d462583f6efa33d09946f9532809
(cherry picked from commit 87f8cbb223ee516803dbb99699320c2484cbf3ba)
Diffstat (limited to 'media/libstagefright')
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp | 9 | ||||
| -rw-r--r-- | media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp | 9 |
2 files changed, 18 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp index c87d19c..d68c682 100644 --- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp +++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp @@ -35,6 +35,10 @@ #include <inttypes.h> +#ifndef INT32_MAX +#define INT32_MAX 2147483647 +#endif + namespace android { template<class T> @@ -123,6 +127,11 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { || mStoreMetaDataInBuffers) { // Color conversion is needed. free(mInputFrameData); + mInputFrameData = NULL; + if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("b/25812794, Buffer size is too big."); + return OMX_ErrorBadParameter; + } mInputFrameData = (uint8_t *) malloc((mVideoWidth * mVideoHeight * 3 ) >> 1); CHECK(mInputFrameData != NULL); diff --git a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp index eb621d5..43f99d4 100644 --- a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp +++ b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp @@ -25,6 +25,10 @@ #include <media/stagefright/foundation/ADebug.h> #include <media/stagefright/MediaDefs.h> +#ifndef INT32_MAX +#define INT32_MAX 2147483647 +#endif + namespace android { template<class T> @@ -369,6 +373,11 @@ status_t SoftVPXEncoder::initEncoder() { if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) { free(mConversionBuffer); + mConversionBuffer = NULL; + if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("b/25812794, Buffer size is too big."); + return UNKNOWN_ERROR; + } mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2); if (mConversionBuffer == NULL) { ALOGE("Allocating conversion buffer failed."); |