commit 33c87057142af8fbc4a684e0f2f3757f165524a3
author Gopalakrishnan Nallasamy <gokrishnan@google.com> Sat Sep 18 00:11:06 2021 -0700
committer Gopalakrishnan Nallasamy <gokrishnan@google.com> Sat Sep 18 07:03:31 2021 -0700
tree 93d008f9c790d23da97de9cac4ec44867af8a61a
parent fbdfa069b6c644f70541e8dd1a29e42286d9f250

FrameDecoder:Return error if dimension is missing

 Decoding non-8-bit or other non-YUV-420 vendor specific pixel
formats causes abort as stride is not present in such cases.
Malicious app can bring down media server by getting a thumbnail from
a 10-bit file.  Hence, if the stride is missing in the format, return
error message instead of aborting.
Handle missing height or width dimensions the same as above.

Bug: 192085013

Test: atest android.media.cts.MediaMetadataRetrieverTest
Change-Id: I3a0cf7d2ff60f378497a27aac43eb839f732fc5a

media/libstagefright/FrameDecoder.cpp

diff --git a/media/libstagefright/FrameDecoder.cpp b/media/libstagefright/FrameDecoder.cpp
index efd4070..b513e45 100644
--- a/media/libstagefright/FrameDecoder.cpp
+++ b/media/libstagefright/FrameDecoder.cpp
@@ -883,9 +883,18 @@
     }
 
     int32_t width, height, stride;
-    CHECK(outputFormat->findInt32("width", &width));
-    CHECK(outputFormat->findInt32("height", &height));
-    CHECK(outputFormat->findInt32("stride", &stride));
+    if (outputFormat->findInt32("width", &width) == false) {
+        ALOGE("MediaImageDecoder::onOutputReceived:width is missing in outputFormat");
+        return ERROR_MALFORMED;
+    }
+    if (outputFormat->findInt32("height", &height) == false) {
+        ALOGE("MediaImageDecoder::onOutputReceived:height is missing in outputFormat");
+        return ERROR_MALFORMED;
+    }
+    if (outputFormat->findInt32("stride", &stride) == false) {
+        ALOGE("MediaImageDecoder::onOutputReceived:stride is missing in outputFormat");
+        return ERROR_MALFORMED;
+    }
 
     if (mFrame == NULL) {
         sp<IMemory> frameMem = allocVideoFrame(