commit 3ab32cd132c82747fb62386b36c297703e89ea34
author Arun Johnson <arunjohnson@google.com> Fri Jun 10 18:58:01 2022 +0000
committer Sungtak Lee <taklee@google.com> Tue Jun 14 20:55:04 2022 +0000
tree abcdb011b5931a5ceddaae06d1f41ff1fefbb48b
parent 3ff1283e23a907bb152f2aff149519f9baafa118

Check bit-depth before creating converters

Added validity checks on in/out Buffers
and pointers

bug: 234907315
Change-Id: Ia304ff79ebcd8719d0c4dd99604efc8ab78aa67f

media/codec2/sfplugin/utils/Codec2BufferUtils.cpp

diff --git a/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp b/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp
index a3a023a..807841e 100644
--- a/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp
+++ b/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp
@@ -121,7 +121,10 @@
 }  // namespace
 
 status_t ImageCopy(uint8_t *imgBase, const MediaImage2 *img, const C2GraphicView &view) {
-    if (view.crop().width != img->mWidth || view.crop().height != img->mHeight) {
+    if (img == nullptr
+        || imgBase == nullptr
+        || view.crop().width != img->mWidth
+        || view.crop().height != img->mHeight) {
         return BAD_VALUE;
     }
     const uint8_t* src_y = view.data()[0];
@@ -203,7 +206,10 @@
 }
 
 status_t ImageCopy(C2GraphicView &view, const uint8_t *imgBase, const MediaImage2 *img) {
-    if (view.crop().width != img->mWidth || view.crop().height != img->mHeight) {
+    if (img == nullptr
+        || imgBase == nullptr
+        || view.crop().width != img->mWidth
+        || view.crop().height != img->mHeight) {
         return BAD_VALUE;
     }
     const uint8_t* src_y = imgBase + img->mPlane[0].mOffset;