commit 099db6603689e6ebf79da7b4ac7b014dba4b5211
author Marco Nelissen <marcone@google.com> Fri Mar 18 20:30:53 2016 +0000
committer android-build-merger <android-build-merger@google.com> Fri Mar 18 20:30:53 2016 +0000
tree 2f79e8de2f86f63b9ecb27a14257e2bf99e37a08
parent 5ff52d6e7ea3642a88d4ad181442ced2a3f67845
parent f79ccd551e6829566243d4cd53c516251e54276d

resolve merge conflicts of c66f8dd to lmp-mr1-dev am: 77e43fa
am: f79ccd5

* commit 'f79ccd551e6829566243d4cd53c516251e54276d':
  Add VPX output buffer size check

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

diff --git a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
index f026761..2586606 100644
--- a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
+++ b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
@@ -150,15 +150,20 @@
             outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;
             outHeader->nFlags = EOSseen ? OMX_BUFFERFLAG_EOS : 0;
             outHeader->nTimeStamp = inHeader->nTimeStamp;
-
-            uint8_t *dst = outHeader->pBuffer;
-            const uint8_t *srcY = (const uint8_t *)mImg->planes[PLANE_Y];
-            const uint8_t *srcU = (const uint8_t *)mImg->planes[PLANE_U];
-            const uint8_t *srcV = (const uint8_t *)mImg->planes[PLANE_V];
-            size_t srcYStride = mImg->stride[PLANE_Y];
-            size_t srcUStride = mImg->stride[PLANE_U];
-            size_t srcVStride = mImg->stride[PLANE_V];
-            copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);
+            if (outHeader->nAllocLen >= outHeader->nFilledLen) {
+                uint8_t *dst = outHeader->pBuffer;
+                const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];
+                const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
+                const uint8_t *srcV = (const uint8_t *)mImg->planes[VPX_PLANE_V];
+                size_t srcYStride = mImg->stride[VPX_PLANE_Y];
+                size_t srcUStride = mImg->stride[VPX_PLANE_U];
+                size_t srcVStride = mImg->stride[VPX_PLANE_V];
+                copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);
+            } else {
+                ALOGE("b/27597103, buffer too small");
+                android_errorWriteLog(0x534e4554, "27597103");
+                outHeader->nFilledLen = 0;
+            }
 
             mImg = NULL;
             outInfo->mOwnedByUs = false;

media/libstagefright/omx/OMX.cpp

diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp
index 97b360d..a943646 100644
--- a/media/libstagefright/omx/OMX.cpp
+++ b/media/libstagefright/omx/OMX.cpp
@@ -172,7 +172,12 @@
         Mutex::Autolock autoLock(mLock);
 
         ssize_t index = mLiveNodes.indexOfKey(the_late_who);
-        CHECK(index >= 0);
+
+        if (index < 0) {
+            ALOGE("b/27597103, nonexistent observer on binderDied");
+            android_errorWriteLog(0x534e4554, "27597103");
+            return;
+        }
 
         instance = mLiveNodes.editValueAt(index);
         mLiveNodes.removeItemsAt(index);