Prevent OOB write in soft_avc encoder
Soft avc encoder cached buffer sizes across a point where the sizes
could be reset by an app, allowing crafted requests to hit outside
of the current buffer. This remedies that by forcing buffer reallocation
with new sizes whenever the encoder state at such 'reset' points.
Bug: 35421151
Test: run POC with no crash
Change-Id: I8c689846142264f7b6a277332260a6bd8a2bd92d
diff --git a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
index b3f5200..62c0adf 100644
--- a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
+++ b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
@@ -611,6 +611,7 @@
IV_STATUS_T status;
WORD32 level;
uint32_t displaySizeY;
+
CHECK(!mStarted);
OMX_ERRORTYPE errType = OMX_ErrorNone;
@@ -913,6 +914,9 @@
}
}
+ // clear other pointers into the space being free()d
+ mCodecCtx = NULL;
+
mStarted = false;
return OMX_ErrorNone;
@@ -1444,6 +1448,14 @@
return;
}
+void SoftAVC::onReset() {
+ SoftVideoEncoderOMXComponent::onReset();
+
+ if (releaseEncoder() != OMX_ErrorNone) {
+ ALOGW("releaseEncoder failed");
+ }
+}
+
} // namespace android
android::SoftOMXComponent *createSoftOMXComponent(
diff --git a/media/libstagefright/codecs/avcenc/SoftAVCEnc.h b/media/libstagefright/codecs/avcenc/SoftAVCEnc.h
index 4418a7f..77aca9b 100644
--- a/media/libstagefright/codecs/avcenc/SoftAVCEnc.h
+++ b/media/libstagefright/codecs/avcenc/SoftAVCEnc.h
@@ -137,6 +137,8 @@
protected:
virtual ~SoftAVC();
+ virtual void onReset();
+
private:
enum {
kNumBuffers = 2,