diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2017-10-05 14:18:26 +0530 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2018-01-10 18:17:55 +0100 |
| commit | 540ed0a3acd4075caa4e8487885002420c420dc7 (patch) | |
| tree | e427b3a3f4af548ad388c68254fa42bcff1be6d8 | |
| parent | 6600fe800cd46d043a2cabaffcf3a8154e39465e (diff) | |
| download | frameworks_av-540ed0a3acd4075caa4e8487885002420c420dc7.tar.gz frameworks_av-540ed0a3acd4075caa4e8487885002420c420dc7.tar.bz2 frameworks_av-540ed0a3acd4075caa4e8487885002420c420dc7.zip | |
SoftAVCDec: Handle zero length input without EOS
When a zero length input buffer is sent to SoftAVC decoder
without EOS set in nFlags, SoftAVC decoder plugin was
entering an infinite loop. Fixed it by returning from
onQueueFilled for such cases.
Bug: 66969349
Test: Tested using poc associated with the bug
Change-Id: I79cebc8f5b40c51256aba83a08deb547b220c4d7
(cherry picked from commit 21943c05f0ee2350647a6fa5ee17aa3c68859383)
CVE-2017-13180
| -rw-r--r-- | media/libstagefright/codecs/avcdec/SoftAVCDec.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp b/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp index c43f9da4c9..2ca0e37b6a 100644 --- a/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp +++ b/media/libstagefright/codecs/avcdec/SoftAVCDec.cpp @@ -545,7 +545,7 @@ void SoftAVC::onQueueFilled(OMX_U32 portIndex) { notifyEmptyBufferDone(inHeader); if (!(inHeader->nFlags & OMX_BUFFERFLAG_EOS)) { - continue; + return; } mReceivedEOS = true; |