From 41d4ad503757189ad401fa82d7572502de0712fa Mon Sep 17 00:00:00 2001
From: Haynes Mathew George <hgeorge@codeaurora.org>
Date: Wed, 6 Jan 2016 17:03:22 -0800
Subject: SoftVorbis: memory access check

Check for valid input buffer header before
reading from it. This seems to be manifested
only when memory map of an input buffer sent from
a remote process fails in mediaserver context.

CRs-Fixed: 916568

Change-Id: I4ee16e7104c2d8bf579f80201864009e51cd1b25
---
 media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp')

diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 3dc549e..08200c1 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -56,7 +56,8 @@ SoftVorbis::SoftVorbis(
       mNumFramesLeftOnPage(-1),
       mSawInputEos(false),
       mSignalledOutputEos(false),
-      mOutputPortSettingsChange(NONE) {
+      mOutputPortSettingsChange(NONE),
+      mSignalledError(false) {
     initPorts();
     CHECK_EQ(initDecoder(), (status_t)OK);
 }
@@ -251,10 +252,21 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) {
         return;
     }
 
+    if (mSignalledError) {
+        return;
+    }
+
     if (portIndex == 0 && mInputBufferCount < 2) {
         BufferInfo *info = *inQueue.begin();
         OMX_BUFFERHEADERTYPE *header = info->mHeader;
 
+        if (!header || !header->pBuffer) {
+            ALOGE("b/25727575 has happened. report error");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         const uint8_t *data = header->pBuffer + header->nOffset;
         size_t size = header->nFilledLen;
 
-- 
cgit v1.1