commit 006e6f165a016e3fd74867269bc1286c013be752
author Wonsik Kim <wonsik@google.com> Wed Mar 30 17:13:00 2016 +0900
committer Wonsik Kim <wonsik@google.com> Thu Mar 31 04:50:06 2016 +0000
tree 55e624020e7598efab7586d13a4500f6024fdec3
parent 4f99823535e09f1a72231b48551b3162d1c5060e

DO NOT MERGE codecs: check OMX buffer size before use in vorbisdec

Bug: 27833616
Change-Id: I1ccdd16a00741da072527a6d13e87fd7c7fe8c54

media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp

diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 9c5fe03..ec3d972 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -271,6 +271,12 @@
 
         const uint8_t *data = header->pBuffer + header->nOffset;
         size_t size = header->nFilledLen;
+        if (size < 7) {
+            ALOGE("Too small input buffer: %zu bytes", size);
+            android_errorWriteLog(0x534e4554, "27833616");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            return;
+        }
 
         ogg_buffer buf;
         ogg_reference ref;
@@ -371,9 +377,14 @@
         if (err != 0) {
             ALOGW("vorbis_dsp_synthesis returned %d", err);
         } else {
+            size_t numSamplesPerBuffer = kMaxNumSamplesPerBuffer;
+            if (numSamplesPerBuffer > outHeader->nAllocLen / sizeof(int16_t)) {
+                numSamplesPerBuffer = outHeader->nAllocLen / sizeof(int16_t);
+                android_errorWriteLog(0x534e4554, "27833616");
+            }
             numFrames = vorbis_dsp_pcmout(
                     mState, (int16_t *)outHeader->pBuffer,
-                    (kMaxNumSamplesPerBuffer / mVi->channels));
+                    (numSamplesPerBuffer / mVi->channels));
 
             if (numFrames < 0) {
                 ALOGE("vorbis_dsp_pcmout returned %d", numFrames);