diff options
| author | Marco Nelissen <marcone@google.com> | 2016-03-16 10:32:05 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-03-25 17:46:44 -0700 |
| commit | f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba (patch) | |
| tree | a5e768aa60bd7ce59fda24188f1c5e028e3ad9c1 /media/libstagefright | |
| parent | de2430fd7855b7941250e1c3744756ec9e699bd1 (diff) | |
| download | frameworks_av-f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba.zip frameworks_av-f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba.tar.gz frameworks_av-f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba.tar.bz2 | |
Add VPX output buffer size check
and handle dead observers more gracefully
Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518
Diffstat (limited to 'media/libstagefright')
| -rw-r--r-- | media/libstagefright/codecs/on2/dec/SoftVPX.cpp | 23 | ||||
| -rw-r--r-- | media/libstagefright/omx/OMX.cpp | 7 |
2 files changed, 20 insertions, 10 deletions
diff --git a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp index e161fb8..02e85a1 100644 --- a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp +++ b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp @@ -149,15 +149,20 @@ bool SoftVPX::outputBuffers(bool flushDecoder, bool display, bool eos, bool *por outHeader->nFlags = 0; outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2; outHeader->nTimeStamp = *(OMX_TICKS *)mImg->user_priv; - - uint8_t *dst = outHeader->pBuffer; - const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y]; - const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U]; - const uint8_t *srcV = (const uint8_t *)mImg->planes[VPX_PLANE_V]; - size_t srcYStride = mImg->stride[VPX_PLANE_Y]; - size_t srcUStride = mImg->stride[VPX_PLANE_U]; - size_t srcVStride = mImg->stride[VPX_PLANE_V]; - copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride); + if (outHeader->nAllocLen >= outHeader->nFilledLen) { + uint8_t *dst = outHeader->pBuffer; + const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y]; + const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U]; + const uint8_t *srcV = (const uint8_t *)mImg->planes[VPX_PLANE_V]; + size_t srcYStride = mImg->stride[VPX_PLANE_Y]; + size_t srcUStride = mImg->stride[VPX_PLANE_U]; + size_t srcVStride = mImg->stride[VPX_PLANE_V]; + copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride); + } else { + ALOGE("b/27597103, buffer too small"); + android_errorWriteLog(0x534e4554, "27597103"); + outHeader->nFilledLen = 0; + } mImg = NULL; outInfo->mOwnedByUs = false; diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp index 7f357c9..56b6055 100644 --- a/media/libstagefright/omx/OMX.cpp +++ b/media/libstagefright/omx/OMX.cpp @@ -179,7 +179,12 @@ void OMX::binderDied(const wp<IBinder> &the_late_who) { Mutex::Autolock autoLock(mLock); ssize_t index = mLiveNodes.indexOfKey(the_late_who); - CHECK(index >= 0); + + if (index < 0) { + ALOGE("b/27597103, nonexistent observer on binderDied"); + android_errorWriteLog(0x534e4554, "27597103"); + return; + } instance = mLiveNodes.editValueAt(index); mLiveNodes.removeItemsAt(index); |