commit 3242dcf6e9f5e01fa2e4fd78feb5db7ec385469d
author Robert Shih <robertshih@google.com> Thu Jul 14 01:26:14 2016 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Jul 14 01:26:14 2016 +0000
tree 2320cbb63ecec044f64c2462e202340336d1d366
parent 91ad8847ab8c4d6c2e6fadf1978d2dd838eeafeb
parent bce5cc9f9d071e1bd5c6c9194a3c8ee289d2d9a1

Merge "DO NOT MERGE - SoftMP3: memset safely" into klp-dev

media/libstagefright/codecs/mp3dec/SoftMP3.cpp

diff --git a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
index 139af11..1221181 100644
--- a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
+++ b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
@@ -118,6 +118,17 @@
     mIsFirst = true;
 }
 
+void *SoftMP3::memsetSafe(OMX_BUFFERHEADERTYPE *outHeader, int c, size_t len) {
+    if (len > outHeader->nAllocLen) {
+        ALOGE("memset buffer too small: got %lu, expected %zu", outHeader->nAllocLen, len);
+        android_errorWriteLog(0x534e4554, "29422022");
+        notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL);
+        mSignalledError = true;
+        return NULL;
+    }
+    return memset(outHeader->pBuffer, c, len);
+}
+
 OMX_ERRORTYPE SoftMP3::internalGetParameter(
         OMX_INDEXTYPE index, OMX_PTR params) {
     switch (index) {
@@ -245,7 +256,9 @@
                 outHeader->nFilledLen =
                     kPVMP3DecoderDelay * mNumChannels * sizeof(int16_t);
 
-                memset(outHeader->pBuffer, 0, outHeader->nFilledLen);
+                if (!memsetSafe(outHeader, 0, outHeader->nFilledLen)) {
+                    return;
+                }
             } else {
                 // Since we never discarded frames from the start, we won't have
                 // to add any padding at the end either.
@@ -305,9 +318,9 @@
 
             // This is recoverable, just ignore the current frame and
             // play silence instead.
-            memset(outHeader->pBuffer,
-                   0,
-                   mConfig->outputFrameSize * sizeof(int16_t));
+            if (!memsetSafe(outHeader, 0, mConfig->outputFrameSize * sizeof(int16_t))) {
+                return;
+            }
 
             mConfig->inputBufferUsedLength = inHeader->nFilledLen;
         } else if (mConfig->samplingRate != mSamplingRate

media/libstagefright/codecs/mp3dec/SoftMP3.h

diff --git a/media/libstagefright/codecs/mp3dec/SoftMP3.h b/media/libstagefright/codecs/mp3dec/SoftMP3.h
index 4af91ea..3e30498 100644
--- a/media/libstagefright/codecs/mp3dec/SoftMP3.h
+++ b/media/libstagefright/codecs/mp3dec/SoftMP3.h
@@ -70,6 +70,7 @@
 
     void initPorts();
     void initDecoder();
+    void *memsetSafe(OMX_BUFFERHEADERTYPE *outHeader, int c, size_t len);
 
     DISALLOW_EVIL_CONSTRUCTORS(SoftMP3);
 };