diff options
| author | Wei Jia <wjia@google.com> | 2016-03-17 11:15:02 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-03-25 17:46:46 -0700 |
| commit | 44749eb4f273f0eb681d0fa013e3beef754fa687 (patch) | |
| tree | 80e9b46954c614dc1725c60267b72d34f7e888b7 /media/libstagefright | |
| parent | 7fd96ebfc4c9da496c59d7c45e1f62be178e626d (diff) | |
| download | frameworks_av-44749eb4f273f0eb681d0fa013e3beef754fa687.zip frameworks_av-44749eb4f273f0eb681d0fa013e3beef754fa687.tar.gz frameworks_av-44749eb4f273f0eb681d0fa013e3beef754fa687.tar.bz2 | |
SoftAMR: check output buffer size to avoid overflow.
Bug: 27662364
Change-Id: I7b26892c41d6f2e690e77478ab855c2fed1ff6b0
Diffstat (limited to 'media/libstagefright')
| -rw-r--r-- | media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp b/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp index a9723ea..bcf6a62 100644 --- a/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp +++ b/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp @@ -312,6 +312,15 @@ void SoftAMR::onQueueFilled(OMX_U32 /* portIndex */) { int32_t numBytesRead; if (mMode == MODE_NARROW) { + if (outHeader->nAllocLen < kNumSamplesPerFrameNB * sizeof(int16_t)) { + ALOGE("b/27662364: NB expected output buffer %zu bytes vs %u", + kNumSamplesPerFrameNB * sizeof(int16_t), outHeader->nAllocLen); + android_errorWriteLog(0x534e4554, "27662364"); + notify(OMX_EventError, OMX_ErrorOverflow, 0, NULL); + mSignalledError = true; + return; + } + numBytesRead = AMRDecode(mState, (Frame_Type_3GPP)((inputPtr[0] >> 3) & 0x0f), @@ -339,6 +348,15 @@ void SoftAMR::onQueueFilled(OMX_U32 /* portIndex */) { return; } } else { + if (outHeader->nAllocLen < kNumSamplesPerFrameWB * sizeof(int16_t)) { + ALOGE("b/27662364: WB expected output buffer %zu bytes vs %u", + kNumSamplesPerFrameWB * sizeof(int16_t), outHeader->nAllocLen); + android_errorWriteLog(0x534e4554, "27662364"); + notify(OMX_EventError, OMX_ErrorOverflow, 0, NULL); + mSignalledError = true; + return; + } + int16 mode = ((inputPtr[0] >> 3) & 0x0f); if (mode >= 10 && mode <= 13) { |