diff options
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/ACodec.cpp | 8 | ||||
| -rw-r--r-- | media/libstagefright/MPEG4Extractor.cpp | 20 | ||||
| -rw-r--r-- | media/libstagefright/SkipCutBuffer.cpp | 7 | ||||
| -rw-r--r-- | media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp | 4 |
4 files changed, 34 insertions, 5 deletions
diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp index 9fda07f..718e6c7 100644 --- a/media/libstagefright/ACodec.cpp +++ b/media/libstagefright/ACodec.cpp @@ -499,7 +499,9 @@ status_t ACodec::allocateBuffersOnPort(OMX_U32 portIndex) { for (OMX_U32 i = 0; i < def.nBufferCountActual; ++i) { sp<IMemory> mem = mDealer[portIndex]->allocate(def.nBufferSize); - CHECK(mem.get() != NULL); + if (mem == NULL || mem->pointer() == NULL) { + return NO_MEMORY; + } BufferInfo info; info.mStatus = BufferInfo::OWNED_BY_US; @@ -756,7 +758,9 @@ status_t ACodec::allocateOutputMetaDataBuffers() { sp<IMemory> mem = mDealer[kPortIndexOutput]->allocate( sizeof(struct VideoDecoderOutputMetaData)); - CHECK(mem.get() != NULL); + if (mem == NULL || mem->pointer() == NULL) { + return NO_MEMORY; + } info.mData = new ABuffer(mem->pointer(), mem->size()); // we use useBuffer for metadata regardless of quirks diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp index 0899362..116c457 100644 --- a/media/libstagefright/MPEG4Extractor.cpp +++ b/media/libstagefright/MPEG4Extractor.cpp @@ -39,6 +39,10 @@ #include <media/stagefright/MetaData.h> #include <utils/String8.h> +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + namespace android { class MPEG4Source : public MediaSource { @@ -2714,13 +2718,27 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(off64_t offset, off return ERROR_IO; } offset += 4; + if (entrycount == 0) { + return OK; + } + if (entrycount > UINT32_MAX / 8) { + return ERROR_MALFORMED; + } if (entrycount > mCurrentSampleInfoOffsetsAllocSize) { - mCurrentSampleInfoOffsets = (uint64_t*) realloc(mCurrentSampleInfoOffsets, entrycount * 8); + uint64_t *newPtr = (uint64_t *)realloc(mCurrentSampleInfoOffsets, entrycount * 8); + if (newPtr == NULL) { + return NO_MEMORY; + } + mCurrentSampleInfoOffsets = newPtr; mCurrentSampleInfoOffsetsAllocSize = entrycount; } mCurrentSampleInfoOffsetCount = entrycount; + if (mCurrentSampleInfoOffsets == NULL) { + return OK; + } + for (size_t i = 0; i < entrycount; i++) { if (version == 0) { uint32_t tmp; diff --git a/media/libstagefright/SkipCutBuffer.cpp b/media/libstagefright/SkipCutBuffer.cpp index 773854f..4d15d7e 100644 --- a/media/libstagefright/SkipCutBuffer.cpp +++ b/media/libstagefright/SkipCutBuffer.cpp @@ -25,6 +25,13 @@ namespace android { SkipCutBuffer::SkipCutBuffer(int32_t skip, int32_t cut) { + + if (skip < 0 || cut < 0 || cut > 64 * 1024) { + ALOGW("out of range skip/cut: %d/%d, using passthrough instead", skip, cut); + skip = 0; + cut = 0; + } + mFrontPadding = skip; mBackPadding = cut; mWriteHead = 0; diff --git a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp index 419e3f4..30d5cbd 100644 --- a/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp +++ b/media/libstagefright/codecs/m4v_h263/dec/src/pvdec_api.cpp @@ -338,7 +338,7 @@ Bool PVAllocVideoData(VideoDecControls *decCtrl, int width, int height, int nLay video->prevVop->uChan = video->prevVop->yChan + size; video->prevVop->vChan = video->prevVop->uChan + (size >> 2); #else - if (size > INT32_MAX / 3 * 2) { + if (size > INT32_MAX / 3) { return PV_FALSE; } video->currVop->yChan = (PIXEL *) oscl_malloc(size * 3 / 2); /* Allocate memory for all VOP OKA 3/2/1*/ @@ -368,7 +368,7 @@ Bool PVAllocVideoData(VideoDecControls *decCtrl, int width, int height, int nLay { oscl_memset(video->prevEnhcVop, 0, sizeof(Vop)); #ifndef PV_MEMORY_POOL - if (size > INT32_MAX / 3 * 2) { + if (size > INT32_MAX / 3) { return PV_FALSE; } |