summaryrefslogtreecommitdiffstats
path: root/media
diff options
context:
space:
mode:
authorWonsik Kim <wonsik@google.com>2016-03-30 17:13:00 +0900
committerThe Android Automerger <android-build@google.com>2016-04-21 19:09:55 -0700
commit4e32001e4196f39ddd0b86686ae0231c8f5ed944 (patch)
tree28146079479037506f2c9d1aca66a9fdf9194c45 /media
parentdb829699d3293f254a7387894303451a91278986 (diff)
downloadframeworks_av-4e32001e4196f39ddd0b86686ae0231c8f5ed944.zip
frameworks_av-4e32001e4196f39ddd0b86686ae0231c8f5ed944.tar.gz
frameworks_av-4e32001e4196f39ddd0b86686ae0231c8f5ed944.tar.bz2
DO NOT MERGE codecs: check OMX buffer size before use in (vorbis|opus)dec
Bug: 27833616 Change-Id: I1ccdd16a00741da072527a6d13e87fd7c7fe8c54
Diffstat (limited to 'media')
-rw-r--r--media/libstagefright/codecs/opus/dec/SoftOpus.cpp7
-rw-r--r--media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp13
2 files changed, 18 insertions, 2 deletions
diff --git a/media/libstagefright/codecs/opus/dec/SoftOpus.cpp b/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
index 2afa0ed..2e44ed7 100644
--- a/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
+++ b/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
@@ -458,12 +458,17 @@ void SoftOpus::onQueueFilled(OMX_U32 portIndex) {
const uint8_t *data = inHeader->pBuffer + inHeader->nOffset;
const uint32_t size = inHeader->nFilledLen;
+ size_t frameSize = kMaxOpusOutputPacketSizeSamples;
+ if (frameSize > outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels) {
+ frameSize = outHeader->nAllocLen / sizeof(int16_t) / mHeader->channels;
+ android_errorWriteLog(0x534e4554, "27833616");
+ }
int numFrames = opus_multistream_decode(mDecoder,
data,
size,
(int16_t *)outHeader->pBuffer,
- kMaxOpusOutputPacketSizeSamples,
+ frameSize,
0);
if (numFrames < 0) {
ALOGE("opus_multistream_decode returned %d", numFrames);
diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 4e1e6a5..5f4e346 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -273,6 +273,12 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
const uint8_t *data = header->pBuffer + header->nOffset;
size_t size = header->nFilledLen;
+ if (size < 7) {
+ ALOGE("Too small input buffer: %zu bytes", size);
+ android_errorWriteLog(0x534e4554, "27833616");
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ return;
+ }
ogg_buffer buf;
ogg_reference ref;
@@ -378,9 +384,14 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
ALOGW("vorbis_dsp_synthesis returned %d", err);
#endif
} else {
+ size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;
+ if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {
+ numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);
+ android_errorWriteLog(0x534e4554, "27833616");
+ }
numFrames = vorbis_dsp_pcmout(
mState, (int16_t *)outHeader->pBuffer,
- (kMaxNumSamplesPerBuffer / mVi->channels));
+ (numSamplesPerBuffer / mVi->channels));
if (numFrames < 0) {
ALOGE("vorbis_dsp_pcmout returned %d", numFrames);