diff options
| author | Wei Jia <wjia@google.com> | 2015-06-08 14:01:42 -0700 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2015-10-19 02:31:25 +0200 |
| commit | b1ef041e2de511818fb382004ce856dcacdf01c5 (patch) | |
| tree | 30a53dbdbd0ad8651d6da433147cca6940259162 /media | |
| parent | dcc0d1aea5b0add92b5724066d98ba3e245927d6 (diff) | |
| download | frameworks_av-b1ef041e2de511818fb382004ce856dcacdf01c5.zip frameworks_av-b1ef041e2de511818fb382004ce856dcacdf01c5.tar.gz frameworks_av-b1ef041e2de511818fb382004ce856dcacdf01c5.tar.bz2 | |
DO NOT MERGE - SoftwareRenderer: sanity check buffer size before copying data.
Bug: 21443020
Change-Id: I63cf86217b8201fb41809c23e4b752b845a93ee2
(cherry picked from commit 760f92f8b6da9c9cf128cb18fe3c09402fdde6cd)
Signed-off-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
Diffstat (limited to 'media')
| -rw-r--r-- | media/libstagefright/colorconversion/SoftwareRenderer.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/media/libstagefright/colorconversion/SoftwareRenderer.cpp b/media/libstagefright/colorconversion/SoftwareRenderer.cpp index 834e6b3..5354f14 100644 --- a/media/libstagefright/colorconversion/SoftwareRenderer.cpp +++ b/media/libstagefright/colorconversion/SoftwareRenderer.cpp @@ -173,6 +173,9 @@ void SoftwareRenderer::render( buf->stride, buf->height, 0, 0, mCropWidth - 1, mCropHeight - 1); } else if (mColorFormat == OMX_COLOR_FormatYUV420Planar) { + if ((size_t)mWidth * mHeight * 3 / 2 > size) { + goto skip_copying; + } const uint8_t *src_y = (const uint8_t *)data; const uint8_t *src_u = (const uint8_t *)data + mWidth * mHeight; const uint8_t *src_v = src_u + (mWidth / 2 * mHeight / 2); @@ -202,6 +205,9 @@ void SoftwareRenderer::render( } } else { CHECK_EQ(mColorFormat, OMX_TI_COLOR_FormatYUV420PackedSemiPlanar); + if ((size_t)mWidth * mHeight * 3 / 2 > size) { + goto skip_copying; + } const uint8_t *src_y = (const uint8_t *)data; @@ -249,6 +255,7 @@ void SoftwareRenderer::render( } } +skip_copying: CHECK_EQ(0, mapper.unlock(buf->handle)); if ((err = mNativeWindow->queueBuffer(mNativeWindow.get(), buf, |