From 295c883fe3105b19bcd0f9e07d54c6b589fc5bff Mon Sep 17 00:00:00 2001 From: Marco Nelissen Date: Mon, 29 Feb 2016 12:47:20 -0800 Subject: DO NOT MERGE Verify OMX buffer sizes prior to access Bug: 27207275 Change-Id: I4412825d1ee233d993af0a67708bea54304ff62d --- .../codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp') diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp index f2a4e65..7638bb7 100644 --- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp +++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp @@ -232,6 +232,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalGetParameter( OMX_VIDEO_PARAM_BITRATETYPE *bitRate = (OMX_VIDEO_PARAM_BITRATETYPE *) params; + if (!isValidOMXParam(bitRate)) { + return OMX_ErrorBadParameter; + } + if (bitRate->nPortIndex != 1) { return OMX_ErrorUndefined; } @@ -246,6 +250,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalGetParameter( OMX_VIDEO_PARAM_H263TYPE *h263type = (OMX_VIDEO_PARAM_H263TYPE *)params; + if (!isValidOMXParam(h263type)) { + return OMX_ErrorBadParameter; + } + if (h263type->nPortIndex != 1) { return OMX_ErrorUndefined; } @@ -267,6 +275,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalGetParameter( OMX_VIDEO_PARAM_MPEG4TYPE *mpeg4type = (OMX_VIDEO_PARAM_MPEG4TYPE *)params; + if (!isValidOMXParam(mpeg4type)) { + return OMX_ErrorBadParameter; + } + if (mpeg4type->nPortIndex != 1) { return OMX_ErrorUndefined; } @@ -301,6 +313,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalSetParameter( OMX_VIDEO_PARAM_BITRATETYPE *bitRate = (OMX_VIDEO_PARAM_BITRATETYPE *) params; + if (!isValidOMXParam(bitRate)) { + return OMX_ErrorBadParameter; + } + if (bitRate->nPortIndex != 1 || bitRate->eControlRate != OMX_Video_ControlRateVariable) { return OMX_ErrorUndefined; @@ -315,6 +331,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalSetParameter( OMX_VIDEO_PARAM_H263TYPE *h263type = (OMX_VIDEO_PARAM_H263TYPE *)params; + if (!isValidOMXParam(h263type)) { + return OMX_ErrorBadParameter; + } + if (h263type->nPortIndex != 1) { return OMX_ErrorUndefined; } @@ -337,6 +357,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::internalSetParameter( OMX_VIDEO_PARAM_MPEG4TYPE *mpeg4type = (OMX_VIDEO_PARAM_MPEG4TYPE *)params; + if (!isValidOMXParam(mpeg4type)) { + return OMX_ErrorBadParameter; + } + if (mpeg4type->nPortIndex != 1) { return OMX_ErrorUndefined; } -- cgit v1.1 From b569311fe413fef4f35114f00485340cc6e322ee Mon Sep 17 00:00:00 2001 From: Pawin Vongmasa Date: Mon, 18 Jul 2016 20:12:02 -0700 Subject: SoftMPEG4: Check the buffer size before writing the reference frame. Also prevent overflow in SoftMPEG4 and division by zero in SoftMPEG4Encoder. Bug: 30033990 Change-Id: I7701f5fc54c2670587d122330e5dc851f64ed3c2 (cherry picked from commit 695123195034402ca76169b195069c28c30342d3) --- media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp') diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp index 7638bb7..2eb51c9 100644 --- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp +++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp @@ -116,6 +116,10 @@ OMX_ERRORTYPE SoftMPEG4Encoder::initEncParams() { ALOGE("Failed to get default encoding parameters"); return OMX_ErrorUndefined; } + if (mFramerate == 0) { + ALOGE("Framerate should not be 0"); + return OMX_ErrorUndefined; + } mEncParams->encMode = mEncodeMode; mEncParams->encWidth[0] = mWidth; mEncParams->encHeight[0] = mHeight; -- cgit v1.1