summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorWei Jia <wjia@google.com>2016-03-17 11:15:02 -0700
committerThe Android Automerger <android-build@google.com>2016-03-25 17:46:46 -0700
commit44749eb4f273f0eb681d0fa013e3beef754fa687 (patch)
tree80e9b46954c614dc1725c60267b72d34f7e888b7 /media
parent7fd96ebfc4c9da496c59d7c45e1f62be178e626d (diff)
downloadframeworks_av-44749eb4f273f0eb681d0fa013e3beef754fa687.zip
frameworks_av-44749eb4f273f0eb681d0fa013e3beef754fa687.tar.gz
frameworks_av-44749eb4f273f0eb681d0fa013e3beef754fa687.tar.bz2
SoftAMR: check output buffer size to avoid overflow.
Bug: 27662364 Change-Id: I7b26892c41d6f2e690e77478ab855c2fed1ff6b0
Diffstat (limited to 'media')
-rw-r--r--media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp18
1 files changed, 18 insertions, 0 deletions
diff --git a/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp b/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp
index a9723ea..bcf6a62 100644
--- a/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp
+++ b/media/libstagefright/codecs/amrnb/dec/SoftAMR.cpp
@@ -312,6 +312,15 @@ void SoftAMR::onQueueFilled(OMX_U32 /* portIndex */) {
int32_t numBytesRead;
if (mMode == MODE_NARROW) {
+ if (outHeader->nAllocLen < kNumSamplesPerFrameNB * sizeof(int16_t)) {
+ ALOGE("b/27662364: NB expected output buffer %zu bytes vs %u",
+ kNumSamplesPerFrameNB * sizeof(int16_t), outHeader->nAllocLen);
+ android_errorWriteLog(0x534e4554, "27662364");
+ notify(OMX_EventError, OMX_ErrorOverflow, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
+
numBytesRead =
AMRDecode(mState,
(Frame_Type_3GPP)((inputPtr[0] >> 3) & 0x0f),
@@ -339,6 +348,15 @@ void SoftAMR::onQueueFilled(OMX_U32 /* portIndex */) {
return;
}
} else {
+ if (outHeader->nAllocLen < kNumSamplesPerFrameWB * sizeof(int16_t)) {
+ ALOGE("b/27662364: WB expected output buffer %zu bytes vs %u",
+ kNumSamplesPerFrameWB * sizeof(int16_t), outHeader->nAllocLen);
+ android_errorWriteLog(0x534e4554, "27662364");
+ notify(OMX_EventError, OMX_ErrorOverflow, 0, NULL);
+ mSignalledError = true;
+ return;
+ }
+
int16 mode = ((inputPtr[0] >> 3) & 0x0f);
if (mode >= 10 && mode <= 13) {