Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_frameworks_av into replicant-6.0

Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>

17 files changed, 240 insertions, 37 deletions

diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
index e01c414..f0afd39 100644
--- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
+++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
@@ -3104,7 +3104,10 @@ int Effect_command(effect_handle_t  self,
             //ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM start");
 
             effect_param_t *p = (effect_param_t *)pCmdData;
-
+            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {
+                android_errorWriteLog(0x534e4554, "26347509");
+                return -EINVAL;
+            }
             if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||
                     cmdSize < (sizeof(effect_param_t) + p->psize) ||
                     pReplyData == NULL || replySize == NULL ||
diff --git a/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp b/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp
index a48a4e3..4dc8b45 100644
--- a/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp
+++ b/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp
@@ -1956,7 +1956,10 @@ int Reverb_command(effect_handle_t  self,
             //ALOGV("\tReverb_command cmdCode Case: "
             //        "EFFECT_CMD_GET_PARAM start");
             effect_param_t *p = (effect_param_t *)pCmdData;
-
+            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {
+                android_errorWriteLog(0x534e4554, "26347509");
+                return -EINVAL;
+            }
             if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||
                     cmdSize < (sizeof(effect_param_t) + p->psize) ||
                     pReplyData == NULL || replySize == NULL ||
diff --git a/media/libmedia/AudioSystem.cpp b/media/libmedia/AudioSystem.cpp
index 9d645f0..10ec495 100644
--- a/media/libmedia/AudioSystem.cpp
+++ b/media/libmedia/AudioSystem.cpp
@@ -37,7 +37,7 @@ sp<IAudioFlinger> AudioSystem::gAudioFlinger;
 sp<AudioSystem::AudioFlingerClient> AudioSystem::gAudioFlingerClient;
 audio_error_callback AudioSystem::gAudioErrorCallback = NULL;
 dynamic_policy_callback AudioSystem::gDynPolicyCallback = NULL;
-
+effect_session_callback AudioSystem::gEffectSessionCallback = NULL;
 
 // establish binder interface to AudioFlinger service
 const sp<IAudioFlinger> AudioSystem::get_audio_flinger()
@@ -652,6 +652,21 @@ status_t AudioSystem::AudioFlingerClient::removeAudioDeviceCallback(
     gDynPolicyCallback = cb;
 }
 
+/*static*/ status_t AudioSystem::setEffectSessionCallback(effect_session_callback cb)
+{
+    const sp<IAudioPolicyService>& aps = AudioSystem::get_audio_policy_service();
+    if (aps == 0) return PERMISSION_DENIED;
+
+    Mutex::Autolock _l(gLock);
+    gEffectSessionCallback = cb;
+
+    status_t status = aps->setEffectSessionCallbacksEnabled(cb != NULL);
+    if (status != OK) {
+        gEffectSessionCallback = NULL;
+    }
+    return status;
+}
+
 // client singleton for AudioPolicyService binder interface
 // protected by gLockAPS
 sp<IAudioPolicyService> AudioSystem::gAudioPolicyService;
@@ -1223,6 +1238,21 @@ void AudioSystem::AudioPolicyServiceClient::onDynamicPolicyMixStateUpdate(
     }
 }
 
+void AudioSystem::AudioPolicyServiceClient::onOutputSessionEffectsUpdate(
+        audio_stream_type_t stream, audio_unique_id_t sessionId, bool added)
+{
+    ALOGV("AudioPolicyServiceClient::onOutputSessionEffectsUpdate(%d, %d, %d)", stream, sessionId, added);
+    effect_session_callback cb = NULL;
+    {
+        Mutex::Autolock _l(AudioSystem::gLock);
+        cb = gEffectSessionCallback;
+    }
+
+    if (cb != NULL) {
+        cb(AUDIO_OUTPUT_SESSION_EFFECTS_UPDATE, stream, sessionId, added);
+    }
+}
+
 void AudioSystem::AudioPolicyServiceClient::binderDied(const wp<IBinder>& who __unused)
 {
     {
diff --git a/media/libmedia/IAudioPolicyService.cpp b/media/libmedia/IAudioPolicyService.cpp
index 76b5924..6ff8149 100644
--- a/media/libmedia/IAudioPolicyService.cpp
+++ b/media/libmedia/IAudioPolicyService.cpp
@@ -74,6 +74,7 @@ enum {
     START_AUDIO_SOURCE,
     STOP_AUDIO_SOURCE,
     SET_AUDIO_PORT_CALLBACK_ENABLED,
+    SET_EFFECT_SESSION_CALLBACK_ENABLED,
 };
 
 #define MAX_ITEMS_PER_LIST 1024
@@ -655,6 +656,18 @@ public:
         remote()->transact(SET_AUDIO_PORT_CALLBACK_ENABLED, data, &reply);
     }
 
+    virtual status_t setEffectSessionCallbacksEnabled(bool enabled)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IAudioPolicyService::getInterfaceDescriptor());
+        data.writeInt32(enabled ? 1 : 0);
+        status_t status = remote()->transact(SET_EFFECT_SESSION_CALLBACK_ENABLED, data, &reply);
+        if (status != NO_ERROR) {
+            return status;
+        }
+        return (status_t)reply.readInt32();
+    }
+
     virtual status_t acquireSoundTriggerSession(audio_session_t *session,
                                             audio_io_handle_t *ioHandle,
                                             audio_devices_t *device)
@@ -1238,6 +1251,13 @@ status_t BnAudioPolicyService::onTransact(
             return NO_ERROR;
         } break;
 
+        case SET_EFFECT_SESSION_CALLBACK_ENABLED: {
+            CHECK_INTERFACE(IAudioPolicyService, data, reply);
+            status_t status = setEffectSessionCallbacksEnabled(data.readInt32() == 1);
+            reply->writeInt32(status);
+            return NO_ERROR;
+        } break;
+
         case ACQUIRE_SOUNDTRIGGER_SESSION: {
             CHECK_INTERFACE(IAudioPolicyService, data, reply);
             sp<IAudioPolicyServiceClient> client = interface_cast<IAudioPolicyServiceClient>(
diff --git a/media/libmedia/IAudioPolicyServiceClient.cpp b/media/libmedia/IAudioPolicyServiceClient.cpp
index 65cc7d6..d6207ce 100644
--- a/media/libmedia/IAudioPolicyServiceClient.cpp
+++ b/media/libmedia/IAudioPolicyServiceClient.cpp
@@ -30,7 +30,8 @@ namespace android {
 enum {
     PORT_LIST_UPDATE = IBinder::FIRST_CALL_TRANSACTION,
     PATCH_LIST_UPDATE,
-    MIX_STATE_UPDATE
+    MIX_STATE_UPDATE,
+    OUTPUT_SESSION_EFFECTS_UPDATE
 };
 
 class BpAudioPolicyServiceClient : public BpInterface<IAudioPolicyServiceClient>
@@ -63,6 +64,17 @@ public:
         data.writeInt32(state);
         remote()->transact(MIX_STATE_UPDATE, data, &reply, IBinder::FLAG_ONEWAY);
     }
+
+    void onOutputSessionEffectsUpdate(audio_stream_type_t stream,
+                                      audio_unique_id_t sessionId, bool added)
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(IAudioPolicyServiceClient::getInterfaceDescriptor());
+        data.writeInt32(stream);
+        data.writeInt32(sessionId);
+        data.writeInt32(added ? 1 : 0);
+        remote()->transact(OUTPUT_SESSION_EFFECTS_UPDATE, data, &reply, IBinder::FLAG_ONEWAY);
+    }
 };
 
 IMPLEMENT_META_INTERFACE(AudioPolicyServiceClient, "android.media.IAudioPolicyServiceClient");
@@ -90,6 +102,14 @@ status_t BnAudioPolicyServiceClient::onTransact(
             onDynamicPolicyMixStateUpdate(regId, state);
             return NO_ERROR;
     }
+    case OUTPUT_SESSION_EFFECTS_UPDATE: {
+            CHECK_INTERFACE(IAudioPolicyServiceClient, data, reply);
+            audio_stream_type_t stream = static_cast<audio_stream_type_t>(data.readInt32());
+            audio_unique_id_t sessionId = static_cast<audio_unique_id_t>(data.readInt32());
+            bool added = data.readInt32() > 0;
+            onOutputSessionEffectsUpdate(stream, sessionId, added);
+            return NO_ERROR;
+    }
     default:
         return BBinder::onTransact(code, data, reply, flags);
     }
diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index da5bb9a..1e911c2 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -1936,8 +1936,13 @@ void MediaPlayerService::AudioOutput::pause()
 void MediaPlayerService::AudioOutput::close()
 {
     ALOGV("close");
-    Mutex::Autolock lock(mLock);
-    close_l();
+    sp<AudioTrack> track;
+    {
+        Mutex::Autolock lock(mLock);
+        track = mTrack;
+        close_l(); // clears mTrack
+    }
+    // destruction of the track occurs outside of mutex.
 }
 
 void MediaPlayerService::AudioOutput::setVolume(float left, float right)
diff --git a/media/libmediaplayerservice/StagefrightRecorder.cpp b/media/libmediaplayerservice/StagefrightRecorder.cpp
index c4c5741..d182a68 100644
--- a/media/libmediaplayerservice/StagefrightRecorder.cpp
+++ b/media/libmediaplayerservice/StagefrightRecorder.cpp
@@ -963,6 +963,30 @@ sp<MediaSource> StagefrightRecorder::createAudioSource() {
         }
     }
 
+    // If using QCOM extension (Camera 1 HAL) for slow motion recording
+    // mCaptureFpsEnable and mCaptureFps will not be set via setCaptureRate
+    // We need to query from AVUtil, in order to support slow motion audio recording
+    if (mVideoSourceNode != NULL) {
+        int hfrRatio =  AVUtils::get()->HFRUtils().getHFRRatio(mVideoSourceNode->getFormat());
+        if (hfrRatio != 1) {
+            // Upscale the sample rate for slow motion recording.
+            // Fail audio source creation if source sample rate is too high, as it could
+            // cause out-of-memory due to large input buffer size. And audio recording
+            // probably doesn't make sense in the scenario, since the slow-down factor
+            // is probably huge (eg. mSampleRate=48K, hfrRatio=240, mFrameRate=1).
+            const static int32_t SAMPLE_RATE_HZ_MAX = 192000;
+            sourceSampleRate =
+                    (mSampleRate * hfrRatio + mFrameRate / 2) / mFrameRate;
+            if (sourceSampleRate < mSampleRate || sourceSampleRate > SAMPLE_RATE_HZ_MAX) {
+                ALOGE("source sample rate out of range! "
+                        "(mSampleRate %d, hfrRatio %d, mFrameRate %d",
+                        mSampleRate, hfrRatio, mFrameRate);
+                return NULL;
+            }
+        }
+    }
+
+
     sp<AudioSource> audioSource = AVFactory::get()->createAudioSource(
         mAudioSource,
         mOpPackageName,
@@ -2044,10 +2068,16 @@ status_t StagefrightRecorder::setSourcePause(bool pause) {
             }
         }
         if (mAudioEncoderOMX != NULL) {
-            err = mAudioEncoderOMX->pause();
-            if (err != OK) {
-                ALOGE("OMX AudioEncoder pause failed");
-                return err;
+            if (mAudioEncoderOMX != mAudioSourceNode) {
+                err = mAudioEncoderOMX->pause();
+                if (err != OK) {
+                    ALOGE("OMX AudioEncoder pause failed");
+                    return err;
+                }
+            } else {
+                // If AudioSource is the same as MediaSource(as in LPCM),
+                // bypass omx encoder pause() call.
+                ALOGV("OMX AudioEncoder->pause() bypassed");
             }
         }
         if (mVideoSourceNode != NULL) {
@@ -2087,10 +2117,16 @@ status_t StagefrightRecorder::setSourcePause(bool pause) {
             }
         }
         if (mAudioEncoderOMX != NULL) {
-            err = mAudioEncoderOMX->start();
-            if (err != OK) {
-                ALOGE("OMX AudioEncoder start failed");
-                return err;
+            if (mAudioEncoderOMX != mAudioSourceNode) {
+                err = mAudioEncoderOMX->start();
+                if (err != OK) {
+                    ALOGE("OMX AudioEncoder start failed");
+                    return err;
+                }
+            } else {
+                // If AudioSource is the same as MediaSource(as in LPCM),
+                // bypass omx encoder start() call.
+                ALOGV("OMX AudioEncoder->start() bypassed");
             }
         }
     }
diff --git a/media/libmediaplayerservice/nuplayer/Android.mk b/media/libmediaplayerservice/nuplayer/Android.mk
index fbb1276..ff2a202 100644
--- a/media/libmediaplayerservice/nuplayer/Android.mk
+++ b/media/libmediaplayerservice/nuplayer/Android.mk
@@ -38,6 +38,10 @@ ifeq ($(TARGET_BOARD_PLATFORM),msm8974)
 LOCAL_CFLAGS += -DTARGET_8974
 endif
 
+ifeq ($(TARGET_NUPLAYER_CANNOT_SET_SURFACE_WITHOUT_A_FLUSH),true)
+LOCAL_CFLAGS += -DCANNOT_SET_SURFACE_WITHOUT_A_FLUSH
+endif
+
 LOCAL_CLANG := true
 
 LOCAL_MODULE:= libstagefright_nuplayer
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayer.cpp b/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
index c87208c..1835101 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
@@ -660,7 +660,10 @@ void NuPlayer::onMessageReceived(const sp<AMessage> &msg) {
             // When mStarted is true, mSource must have been set.
             if (mSource == NULL || !mStarted || mSource->getFormat(false /* audio */) == NULL
                     // NOTE: mVideoDecoder's mSurface is always non-null
-                    || (mVideoDecoder != NULL && mVideoDecoder->setVideoSurface(surface) == OK)) {
+#ifndef CANNOT_SET_SURFACE_WITHOUT_A_FLUSH
+                    || (mVideoDecoder != NULL && mVideoDecoder->setVideoSurface(surface) == OK)
+#endif
+                ) {
                 performSetSurface(surface);
                 break;
             }
@@ -932,10 +935,21 @@ void NuPlayer::onMessageReceived(const sp<AMessage> &msg) {
                         audio ? "audio" : "video", formatChange);
 
                 if (formatChange) {
-                    mDeferredActions.push_back(
-                            new FlushDecoderAction(
+                    int32_t seamlessChange = 0;
+                    if (msg->findInt32("video-seamlessChange", &seamlessChange) && seamlessChange) {
+                        ALOGE("video decoder seamlessChange in smooth streaming mode, "
+                             "flush the video decoder");
+                        mDeferredActions.push_back(
+                                new FlushDecoderAction(FLUSH_CMD_NONE, FLUSH_CMD_FLUSH));
+                        mDeferredActions.push_back(new ResumeDecoderAction(false));
+                        processDeferredActions();
+                        break;
+                    } else {
+                        mDeferredActions.push_back(
+                                new FlushDecoderAction(
                                 audio ? FLUSH_CMD_SHUTDOWN : FLUSH_CMD_NONE,
                                 audio ? FLUSH_CMD_NONE : FLUSH_CMD_SHUTDOWN));
+                    }
                 }
 
                 mDeferredActions.push_back(
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp
index c505096..a18e1da 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp
@@ -73,6 +73,7 @@ NuPlayer::Decoder::Decoder(
       mIsSecure(false),
       mFormatChangePending(false),
       mTimeChangePending(false),
+      mVideoFormatChangeDoFlushOnly(false),
       mResumePending(false),
       mComponentName("decoder") {
     mCodecLooper = new ALooper;
@@ -243,6 +244,7 @@ void NuPlayer::Decoder::onConfigure(const sp<AMessage> &format) {
 
     mFormatChangePending = false;
     mTimeChangePending = false;
+    mVideoFormatChangeDoFlushOnly = false;
 
     ++mBufferGeneration;
 
@@ -759,9 +761,20 @@ status_t NuPlayer::Decoder::fetchInputData(sp<AMessage> &reply) {
                     mTimeChangePending = true;
                     err = ERROR_END_OF_STREAM;
                 } else if (seamlessFormatChange) {
-                    // reuse existing decoder and don't flush
-                    rememberCodecSpecificData(newFormat);
-                    continue;
+                    if (!mIsAudio &&
+                            newFormat != NULL &&
+                            newFormat->contains("prefer-adaptive-playback")) {
+                        ALOGV("in smooth streaming mode, "
+                             "do video flush in video seamless format change");
+                        mFormatChangePending = true;
+                        mVideoFormatChangeDoFlushOnly = true;
+                        err = ERROR_END_OF_STREAM;
+                    } else {
+                        // reuse existing decoder and don't flush
+                        rememberCodecSpecificData(newFormat);
+                        continue;
+                    }
+
                 } else {
                     // This stream is unaffected by the discontinuity
                     return -EWOULDBLOCK;
@@ -989,10 +1002,14 @@ void NuPlayer::Decoder::finishHandleDiscontinuity(bool flushOnTimeChange) {
     sp<AMessage> msg = mNotify->dup();
     msg->setInt32("what", kWhatInputDiscontinuity);
     msg->setInt32("formatChange", mFormatChangePending);
+    if (mVideoFormatChangeDoFlushOnly) {
+        msg->setInt32("video-seamlessChange", mVideoFormatChangeDoFlushOnly);
+    }
     msg->post();
 
     mFormatChangePending = false;
     mTimeChangePending = false;
+    mVideoFormatChangeDoFlushOnly = false;
 }
 
 bool NuPlayer::Decoder::supportsSeamlessAudioFormatChange(
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.h b/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.h
index 6e2b9d0..1fbefda 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.h
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.h
@@ -95,6 +95,7 @@ protected:
     bool mIsSecure;
     bool mFormatChangePending;
     bool mTimeChangePending;
+    bool mVideoFormatChangeDoFlushOnly;
 
     bool mResumePending;
     AString mComponentName;
diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp
index 4807b65..b83d6c6 100644
--- a/media/libstagefright/ACodec.cpp
+++ b/media/libstagefright/ACodec.cpp
@@ -767,7 +767,8 @@ status_t ACodec::handleSetSurface(const sp<Surface> &surface) {
     }
 
     // push blank buffers to previous window if requested
-    if (mFlags & kFlagPushBlankBuffersToNativeWindowOnShutdown) {
+    if (mFlags & kFlagPushBlankBuffersToNativeWindowOnShutdown ||
+        mFlags & kFlagPushBlankBuffersToNativeWindowOnSwitch) {
         pushBlankBuffersToNativeWindow(mNativeWindow.get());
     }
 
@@ -925,10 +926,24 @@ status_t ACodec::setupNativeWindowSizeFormatAndUsage(
 #endif
 
     ALOGV("gralloc usage: %#x(OMX) => %#x(ACodec)", omxUsage, usage);
+    int32_t width = 0, height = 0;
+    int32_t isAdaptivePlayback = 0;
+
+    if (mInputFormat->findInt32("adaptive-playback", &isAdaptivePlayback)
+            && isAdaptivePlayback
+            && mInputFormat->findInt32("max-width", &width)
+            && mInputFormat->findInt32("max-height", &height)) {
+        width = max(width, (int32_t)def.format.video.nFrameWidth);
+        height = max(height, (int32_t)def.format.video.nFrameHeight);
+        ALOGV("Adaptive playback width = %d, height = %d", width, height);
+    } else {
+        width = def.format.video.nFrameWidth;
+        height = def.format.video.nFrameHeight;
+    }
     err = setNativeWindowSizeFormatAndUsage(
             nativeWindow,
-            def.format.video.nFrameWidth,
-            def.format.video.nFrameHeight,
+            width,
+            height,
 #ifdef USE_SAMSUNG_COLORFORMAT
             eNativeColorFormat,
 #else
@@ -1969,6 +1984,12 @@ status_t ACodec::configureCodec(
                     && push != 0) {
                 mFlags |= kFlagPushBlankBuffersToNativeWindowOnShutdown;
             }
+
+            int32_t val;
+            if (msg->findInt32("push-blank-buffers-on-switch", &val)
+                    && val != 0) {
+                mFlags |= kFlagPushBlankBuffersToNativeWindowOnSwitch;
+            }
         }
 
         int32_t rotationDegrees;
@@ -6760,6 +6781,11 @@ bool ACodec::OutputPortSettingsChangedState::onOMXEvent(
                             mCodec->mNode, OMX_CommandPortEnable, kPortIndexOutput);
                 }
 
+                /* Clear the RenderQueue in which queued GraphicBuffers hold the
+                 * actual buffer references in order to free them early.
+                 */
+                mCodec->mRenderTracker.clear(systemTime(CLOCK_MONOTONIC));
+
                 if (err == OK) {
                     err = mCodec->allocateBuffersOnPort(kPortIndexOutput);
                     ALOGE_IF(err != OK, "Failed to allocate output port buffers after port "
diff --git a/media/libstagefright/DataSource.cpp b/media/libstagefright/DataSource.cpp
index b833f9e..34f0649 100644
--- a/media/libstagefright/DataSource.cpp
+++ b/media/libstagefright/DataSource.cpp
@@ -38,7 +38,6 @@
 #include <media/IMediaHTTPConnection.h>
 #include <media/IMediaHTTPService.h>
 #include <media/stagefright/foundation/ADebug.h>
-#include <media/stagefright/foundation/AMessage.h>
 #include <media/stagefright/DataSource.h>
 #include <media/stagefright/DataURISource.h>
 #include <media/stagefright/FileSource.h>
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index c928495..c7c238e 100755
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -3325,11 +3325,13 @@ MPEG4Source::MPEG4Source(
 
         const uint8_t *ptr = (const uint8_t *)data;
 
-        CHECK(size >= 7);
-        CHECK_EQ((unsigned)ptr[0], 1u);  // configurationVersion == 1
-
-        // The number of bytes used to encode the length of a NAL unit.
-        mNALLengthSize = 1 + (ptr[4] & 3);
+        if (size < 7 || ptr[0] != 1) {
+            ALOGE("Invalid AVCC atom, size %zu, configurationVersion: %d",
+                    size, ptr[0]);
+        } else {
+            // The number of bytes used to encode the length of a NAL unit.
+            mNALLengthSize = 1 + (ptr[4] & 3);
+        }
     } else if (mIsHEVC) {
         uint32_t type;
         const void *data;
@@ -4573,7 +4575,15 @@ status_t MPEG4Source::fragmentedRead(
                     continue;
                 }
 
-                CHECK(dstOffset + 4 <= mBuffer->size());
+                if (dstOffset > SIZE_MAX - 4 ||
+                        dstOffset + 4 > SIZE_MAX - nalLength ||
+                        dstOffset + 4 + nalLength > mBuffer->size()) {
+                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());
+                    android_errorWriteLog(0x534e4554, "26365349");
+                    mBuffer->release();
+                    mBuffer = NULL;
+                    return ERROR_MALFORMED;
+                }
 
                 dstData[dstOffset++] = 0;
                 dstData[dstOffset++] = 0;
diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 3dc549e..08200c1 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -56,7 +56,8 @@ SoftVorbis::SoftVorbis(
       mNumFramesLeftOnPage(-1),
       mSawInputEos(false),
       mSignalledOutputEos(false),
-      mOutputPortSettingsChange(NONE) {
+      mOutputPortSettingsChange(NONE),
+      mSignalledError(false) {
     initPorts();
     CHECK_EQ(initDecoder(), (status_t)OK);
 }
@@ -251,10 +252,21 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
         return;
     }
 
+    if (mSignalledError) {
+        return;
+    }
+
     if (portIndex == 0 && mInputBufferCount < 2) {
         BufferInfo *info = *inQueue.begin();
         OMX_BUFFERHEADERTYPE *header = info->mHeader;
 
+        if (!header || !header->pBuffer) {
+            ALOGE("b/25727575 has happened. report error");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         const uint8_t *data = header->pBuffer + header->nOffset;
         size_t size = header->nFilledLen;
 
diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h
index 1d00816..7decc5a 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.h
@@ -68,6 +68,8 @@ private:
         AWAITING_ENABLED
     } mOutputPortSettingsChange;
 
+    bool mSignalledError;
+
     void initPorts();
     status_t initDecoder();
     bool isConfigured() const;
diff --git a/media/libstagefright/matroska/MatroskaExtractor.cpp b/media/libstagefright/matroska/MatroskaExtractor.cpp
index c1fa240..b2463e7 100644
--- a/media/libstagefright/matroska/MatroskaExtractor.cpp
+++ b/media/libstagefright/matroska/MatroskaExtractor.cpp
@@ -224,18 +224,19 @@ MatroskaSource::MatroskaSource(
     mIsAudio = !strncasecmp("audio/", mime, 6);
 
     if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_AVC)) {
-        mType = AVC;
-
         uint32_t dummy;
         const uint8_t *avcc;
         size_t avccSize;
         CHECK(meta->findData(
                     kKeyAVCC, &dummy, (const void **)&avcc, &avccSize));
 
-        CHECK_GE(avccSize, 5u);
-
-        mNALSizeLen = 1 + (avcc[4] & 3);
-        ALOGV("mNALSizeLen = %zu", mNALSizeLen);
+        if (avccSize < 7) {
+            ALOGW("Invalid AVCC atom in track, size %zu", avccSize);
+        } else {
+            mNALSizeLen = 1 + (avcc[4] & 3);
+            ALOGV("mNALSizeLen = %zu", mNALSizeLen);
+            mType = AVC;
+        }
     } else if (!strcasecmp(mime, MEDIA_MIMETYPE_VIDEO_HEVC)) {
         mType = HEVC;