commit 2a05d85b98361d4e1f24fbb2ae19873ce7db6db4
author Marco Nelissen <marcone@google.com> Thu Apr 07 21:37:36 2016 +0000
committer android-build-merger <android-build-merger@google.com> Thu Apr 07 21:37:36 2016 +0000
tree cf11486a31cf500f042281c342d8dc3b278d526c
parent 211ec4d5a50b9833accc1885a19e9811cf9c59bf
parent a70a752e110d436c24195037e3ade612fe2d15bd

Merge "Check mp3 output buffer size" into klp-dev am: bc736f6 am: 44ef399
am: a70a752

* commit 'a70a752e110d436c24195037e3ade612fe2d15bd':
  Check mp3 output buffer size

Change-Id: Ic909905135d8871ebbef12515b69761bf3e42452

media/libstagefright/codecs/mp3dec/SoftMP3.cpp

diff --git a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
index fcb2c7e..451636c 100644
--- a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
+++ b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
@@ -263,6 +263,14 @@
         mConfig->inputBufferUsedLength = 0;
 
         mConfig->outputFrameSize = kOutputBufferSize / sizeof(int16_t);
+        if ((int32)outHeader->nAllocLen < mConfig->outputFrameSize) {
+            ALOGE("input buffer too small: got %lu, expected %u",
+                outHeader->nAllocLen, mConfig->outputFrameSize);
+            android_errorWriteLog(0x534e4554, "27793371");
+            notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL);
+            mSignalledError = true;
+            return;
+        }
 
         mConfig->pOutputBuffer =
             reinterpret_cast<int16_t *>(outHeader->pBuffer);