commit 00209af1ec4d789554a5caafa80dbdb3d4798aec
author Dongwon Kang <dwkang@google.com> Mon Jul 24 13:59:51 2017 -0700
committer Dongwon Kang <dwkang@google.com> Tue Aug 15 14:49:24 2017 -0700
tree 2d79d3c7d8aa8092b28fe848150f3377ce9ebe44
parent 8a4f540bdff1dc12dc1fec4602e9a672483e9eeb

Check buffer size in useBuffer in software components

Test: No more crash from oob read/write with running poc.
Bug: 63522430
Change-Id: I38f1e3c7c809bda064401e8eebe768c921dc21c2

media/libstagefright/omx/SimpleSoftOMXComponent.cpp

diff --git a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
index 7c975f7..76cbbc4 100644
--- a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
+++ b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
@@ -199,6 +199,13 @@
     Mutex::Autolock autoLock(mLock);
     CHECK_LT(portIndex, mPorts.size());
 
+    PortInfo *port = &mPorts.editItemAt(portIndex);
+    if (size < port->mDef.nBufferSize) {
+        ALOGE("b/63522430, Buffer size is too small.");
+        android_errorWriteLog(0x534e4554, "63522430");
+        return OMX_ErrorBadParameter;
+    }
+
     *header = new OMX_BUFFERHEADERTYPE;
     (*header)->nSize = sizeof(OMX_BUFFERHEADERTYPE);
     (*header)->nVersion.s.nVersionMajor = 1;
@@ -221,8 +228,6 @@
     (*header)->nOutputPortIndex = portIndex;
     (*header)->nInputPortIndex = portIndex;
 
-    PortInfo *port = &mPorts.editItemAt(portIndex);
-
     CHECK(mState == OMX_StateLoaded || port->mDef.bEnabled == OMX_FALSE);
 
     CHECK_LT(port->mBuffers.size(), port->mDef.nBufferCountActual);