diff options
author | Wei Jia <wjia@google.com> | 2015-06-08 18:28:47 +0000 |
---|---|---|
committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-06-08 18:28:47 +0000 |
commit | a31d237241545d7d2e1b5663426de06dea2426d4 (patch) | |
tree | b93e31d54c98fb030af73290ffb72346563985c8 /media/libstagefright | |
parent | 72249d5b2f9f42a96c0e0825431e8f3f49b82644 (diff) | |
parent | f6fe4340219a8e674f3250fe32d4697ec8184b24 (diff) | |
download | frameworks_av-a31d237241545d7d2e1b5663426de06dea2426d4.zip frameworks_av-a31d237241545d7d2e1b5663426de06dea2426d4.tar.gz frameworks_av-a31d237241545d7d2e1b5663426de06dea2426d4.tar.bz2 |
Merge "SoftAVCEnc: check requested memory size before allocation." into mnc-dev
Diffstat (limited to 'media/libstagefright')
-rwxr-xr-x | media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp index 449d195..a00f324 100755 --- a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp +++ b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp @@ -634,6 +634,10 @@ OMX_ERRORTYPE SoftAVC::initEncoder() { } if (mConversionBuffer == NULL) { + if (((uint64_t)mStride * mHeight) > (((uint64_t)INT32_MAX / 3) * 2)) { + ALOGE("Buffer size is too big."); + return OMX_ErrorUndefined; + } mConversionBuffer = (uint8_t *)malloc(mStride * mHeight * 3 / 2); if (mConversionBuffer == NULL) { ALOGE("Allocating conversion buffer failed."); @@ -679,6 +683,10 @@ OMX_ERRORTYPE SoftAVC::initEncoder() { } /* Allocate array to hold memory records */ + if (mNumMemRecords > SIZE_MAX / sizeof(iv_mem_rec_t)) { + ALOGE("requested memory size is too big."); + return OMX_ErrorUndefined; + } mMemRecords = (iv_mem_rec_t *)malloc(mNumMemRecords * sizeof(iv_mem_rec_t)); if (NULL == mMemRecords) { ALOGE("Unable to allocate memory for hold memory records: Size %zu", |