diff options
| author | Wei Jia <wjia@google.com> | 2015-12-03 17:53:24 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2015-12-03 17:53:24 +0000 |
| commit | 9e1d7751b12ea976323abc1fe7760323ab142d39 (patch) | |
| tree | 55956286a4785e4d6b6efd5a090f149f0f9404eb /media | |
| parent | 781cd4f37d4b81a8e5af45a3ba6cdd4cdd209a3e (diff) | |
| parent | 6afc659b00c3f4a83b9f5f3c744b7119b33340b4 (diff) | |
| download | frameworks_av-9e1d7751b12ea976323abc1fe7760323ab142d39.zip frameworks_av-9e1d7751b12ea976323abc1fe7760323ab142d39.tar.gz frameworks_av-9e1d7751b12ea976323abc1fe7760323ab142d39.tar.bz2 | |
DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
am: 6afc659b00
* commit '6afc659b00c3f4a83b9f5f3c744b7119b33340b4':
DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp | 11 | ||||
| -rw-r--r-- | media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp | 8 |
2 files changed, 18 insertions, 1 deletions
diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp index e02af90..9f03502 100644 --- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp +++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp @@ -33,6 +33,10 @@ #include "SoftMPEG4Encoder.h" +#ifndef INT32_MAX +#define INT32_MAX 2147483647 +#endif + namespace android { template<class T> @@ -149,7 +153,12 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { if (mVideoColorFormat == OMX_COLOR_FormatYUV420SemiPlanar) { // Color conversion is needed. - CHECK(mInputFrameData == NULL); + free(mInputFrameData); + mInputFrameData = NULL; + if (((uint64_t)mVideoWidth * mVideoHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("b/25812794, Buffer size is too big."); + return OMX_ErrorBadParameter; + } mInputFrameData = (uint8_t *) malloc((mVideoWidth * mVideoHeight * 3 ) >> 1); CHECK(mInputFrameData != NULL); diff --git a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp index 8375cac..50eb6bf 100644 --- a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp +++ b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp @@ -25,6 +25,10 @@ #include <media/stagefright/foundation/ADebug.h> #include <media/stagefright/MediaDefs.h> +#ifndef INT32_MAX +#define INT32_MAX 2147483647 +#endif + namespace android { @@ -300,6 +304,10 @@ status_t SoftVPXEncoder::initEncoder() { if (mColorFormat == OMX_COLOR_FormatYUV420SemiPlanar || mInputDataIsMeta) { if (mConversionBuffer == NULL) { + if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) { + ALOGE("b/25812794, Buffer size is too big."); + return UNKNOWN_ERROR; + } mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2); if (mConversionBuffer == NULL) { ALOGE("Allocating conversion buffer failed."); |