commit 502dc6a613dac2a648436f3c87a826390d48baf9
author Wonsik Kim <wonsik@google.com> Fri Jun 28 21:02:11 2024 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri Jun 28 21:02:11 2024 +0000
tree 78451bd930a36c56293f45422c9e9710fd4565c8
parent 318c1336710e0b49d5f4509e469e618f0b92057b
parent 53298956ba6bb8f147a632d7aaed8566dfc203ee

Merge "omx: check HDR10+ info param size" into main

media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp

diff --git a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
index 4183023..4ab5d10 100644
--- a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
+++ b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
@@ -619,6 +619,13 @@
                 if (!isValidOMXParam(outParams)) {
                     return OMX_ErrorBadParameter;
                 }
+                if (offsetof(DescribeHDR10PlusInfoParams, nValue) + outParams->nParamSize >
+                    outParams->nSize) {
+                    ALOGE("b/329641908: too large param size; nParamSize=%u nSize=%u",
+                          outParams->nParamSize, outParams->nSize);
+                    android_errorWriteLog(0x534e4554, "329641908");
+                    return OMX_ErrorBadParameter;
+                }
 
                 outParams->nParamSizeUsed = info->size();