diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-06-11 03:42:58 -0600 |
|---|---|---|
| committer | Linux Build Service Account <lnxbuild@localhost> | 2017-06-11 03:42:58 -0600 |
| commit | 3b4fef61e3a1eabed9828ef23fa6825480988d70 (patch) | |
| tree | ea880347cadba517c62b2d3eff9dba66cfc2be1c | |
| parent | a3818891eca3870076a69ad49aca83a64c5fb34a (diff) | |
| parent | d40705f1fcd333f8e8115dd69555f9e9facfa78c (diff) | |
| download | hardware_qcom_audio-3b4fef61e3a1eabed9828ef23fa6825480988d70.tar.gz hardware_qcom_audio-3b4fef61e3a1eabed9828ef23fa6825480988d70.tar.bz2 hardware_qcom_audio-3b4fef61e3a1eabed9828ef23fa6825480988d70.zip | |
Merge d40705f1fcd333f8e8115dd69555f9e9facfa78c on remote branch
Change-Id: I13f43e6d7b66e1ea70738aa764dd9800a6c97794
| -rw-r--r-- | mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp b/mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp index d2dd1d0e..9c9fbf50 100644 --- a/mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp +++ b/mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2010-2016, The Linux Foundation. All rights reserved. +Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -4178,14 +4178,25 @@ OMX_ERRORTYPE omx_aac_aenc::fill_this_buffer_proxy DEBUG_DETAIL("FTBP->Al_len[%lu]buf[%p]size[%d]numOutBuf[%d]\n",\ buffer->nAllocLen,m_tmp_out_meta_buf, nReadbytes,nNumOutputBuf); - if(*m_tmp_out_meta_buf <= 0) + if(m_tmp_out_meta_buf == NULL) + return OMX_ErrorUndefined; + + if(*m_tmp_out_meta_buf <= 0 || *m_tmp_out_meta_buf > CHAR_MAX) return OMX_ErrorBadParameter; - szadifhr = AUDAAC_MAX_ADIF_HEADER_LENGTH; + szadifhr = AUDAAC_MAX_ADIF_HEADER_LENGTH; numframes = *m_tmp_out_meta_buf; metainfo = (int)((sizeof(ENC_META_OUT) * numframes)+ - sizeof(unsigned char)); + sizeof(unsigned char)); + /* + * add bounds checking + */ + if ((metainfo > INT_MAX - szadifhr) || + (buffer->nAllocLen < (nReadbytes + szadifhr)) || + (metainfo > nReadbytes)) { + return OMX_ErrorBadParameter; + } audaac_rec_install_adif_header_variable(0,sample_idx, - (OMX_U8)m_aac_param.nChannels); + (OMX_U8)m_aac_param.nChannels); memcpy(buffer->pBuffer,m_tmp_out_meta_buf,metainfo); memcpy(buffer->pBuffer + metainfo,&audaac_header_adif[0],szadifhr); memcpy(buffer->pBuffer + metainfo + szadifhr, |