1 files changed, 49 insertions, 33 deletions

diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 5356494..346c37e 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -447,7 +447,7 @@ public:
         remote()->transact(CONFIGURE_VIDEO_TUNNEL_MODE, data, &reply);
 
         status_t err = reply.readInt32();
-        if (sidebandHandle) {
+        if (err == OK && sidebandHandle) {
             *sidebandHandle = (native_handle_t *)reply.readNativeHandle();
         }
         return err;
@@ -694,34 +694,39 @@ status_t BnOMX::onTransact(
 
             size_t size = data.readInt64();
 
-            void *params = malloc(size);
-            data.read(params, size);
-
-            status_t err;
-            switch (code) {
-                case GET_PARAMETER:
-                    err = getParameter(node, index, params, size);
-                    break;
-                case SET_PARAMETER:
-                    err = setParameter(node, index, params, size);
-                    break;
-                case GET_CONFIG:
-                    err = getConfig(node, index, params, size);
-                    break;
-                case SET_CONFIG:
-                    err = setConfig(node, index, params, size);
-                    break;
-                case SET_INTERNAL_OPTION:
-                {
-                    InternalOptionType type =
-                        (InternalOptionType)data.readInt32();
-
-                    err = setInternalOption(node, index, type, params, size);
-                    break;
+            status_t err = NO_MEMORY;
+            void *params = calloc(size, 1);
+            if (params) {
+                err = data.read(params, size);
+                if (err != OK) {
+                    android_errorWriteLog(0x534e4554, "26914474");
+                } else {
+                    switch (code) {
+                        case GET_PARAMETER:
+                            err = getParameter(node, index, params, size);
+                            break;
+                        case SET_PARAMETER:
+                            err = setParameter(node, index, params, size);
+                            break;
+                        case GET_CONFIG:
+                            err = getConfig(node, index, params, size);
+                            break;
+                        case SET_CONFIG:
+                            err = setConfig(node, index, params, size);
+                            break;
+                        case SET_INTERNAL_OPTION:
+                        {
+                            InternalOptionType type =
+                                (InternalOptionType)data.readInt32();
+
+                            err = setInternalOption(node, index, type, params, size);
+                            break;
+                        }
+
+                        default:
+                            TRESPASS();
+                    }
                 }
-
-                default:
-                    TRESPASS();
             }
 
             reply->writeInt32(err);
@@ -846,9 +851,13 @@ status_t BnOMX::onTransact(
             OMX_U32 port_index = data.readInt32();
 
             sp<IGraphicBufferProducer> bufferProducer;
-            MetadataBufferType type;
+            MetadataBufferType type = kMetadataBufferTypeInvalid;
             status_t err = createInputSurface(node, port_index, &bufferProducer, &type);
 
+            if ((err != OK) && (type == kMetadataBufferTypeInvalid)) {
+                android_errorWriteLog(0x534e4554, "26324358");
+            }
+
             reply->writeInt32(type);
             reply->writeInt32(err);
 
@@ -888,9 +897,13 @@ status_t BnOMX::onTransact(
             sp<IGraphicBufferConsumer> bufferConsumer =
                     interface_cast<IGraphicBufferConsumer>(data.readStrongBinder());
 
-            MetadataBufferType type;
+            MetadataBufferType type = kMetadataBufferTypeInvalid;
             status_t err = setInputSurface(node, port_index, bufferConsumer, &type);
 
+            if ((err != OK) && (type == kMetadataBufferTypeInvalid)) {
+                android_errorWriteLog(0x534e4554, "26324358");
+            }
+
             reply->writeInt32(type);
             reply->writeInt32(err);
             return NO_ERROR;
@@ -916,8 +929,9 @@ status_t BnOMX::onTransact(
             OMX_U32 port_index = data.readInt32();
             OMX_BOOL enable = (OMX_BOOL)data.readInt32();
 
-            MetadataBufferType type;
+            MetadataBufferType type = kMetadataBufferTypeInvalid;
             status_t err = storeMetaDataInBuffers(node, port_index, enable, &type);
+
             reply->writeInt32(type);
             reply->writeInt32(err);
 
@@ -950,11 +964,13 @@ status_t BnOMX::onTransact(
             OMX_BOOL tunneled = (OMX_BOOL)data.readInt32();
             OMX_U32 audio_hw_sync = data.readInt32();
 
-            native_handle_t *sideband_handle;
+            native_handle_t *sideband_handle = NULL;
             status_t err = configureVideoTunnelMode(
                     node, port_index, tunneled, audio_hw_sync, &sideband_handle);
             reply->writeInt32(err);
-            reply->writeNativeHandle(sideband_handle);
+            if(err == OK){
+                reply->writeNativeHandle(sideband_handle);
+            }
 
             return NO_ERROR;
         }