commit 530cf7afef16eacfa6ff5290ab3fb6b46631c2f8
author Ray Essick <essick@google.com> Mon Mar 13 23:38:19 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Mar 13 23:38:19 2017 +0000
tree bd0419c1bb630e499d3fa01301e412bcca4623fe
parent ce559427fd7bb7962188c38db746d9f06f6c8064
parent 9ab3187ff54328450f95887dcefb474dd3804d1e

Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752 am: 8e3cf4d841 am: 5b1bfc1f43 am: 8abf11b512 am: 4bc4f78933 am: 7f2592fe4a am: dbdf026f76 am: c4305aeda4 am: 1baad9ad99 am: 2ad7f9b172 am: 457bde5e35 am: ed1109257a
am: 9ab3187ff5

Change-Id: Id973b57ec24481f0852bd3b468eb37b1c0c4fa9c

media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp

diff --git a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
index c55d536..44415e2 100644
--- a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
+++ b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
@@ -512,6 +512,15 @@
 
         BufferInfo *outInfo = *outQueue.begin();
         OMX_BUFFERHEADERTYPE *outHeader = outInfo->mHeader;
+
+        if (outHeader->nOffset + encInfo.confSize > outHeader->nAllocLen) {
+            ALOGE("b/34617444");
+            android_errorWriteLog(0x534e4554,"34617444");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         outHeader->nFilledLen = encInfo.confSize;
         outHeader->nFlags = OMX_BUFFERFLAG_CODECCONFIG;