commit 5b1bfc1f43b1341b462868fdaa8a2d74da5d2714
author Ray Essick <essick@google.com> Mon Mar 13 22:48:10 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Mar 13 22:48:10 2017 +0000
tree 782ac6869f65b302f29f9e78b99fc75aefef99a9
parent f5c7784dbd3de07e4e16da74b6c63e219c508d3f
parent 8e3cf4d841a99c558d9ae3072eb7094cabce14ad

Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752
am: 8e3cf4d841

Change-Id: I804c61a21202d3c5aef3edac5872f56cef67753b

media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp

diff --git a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
index 5e80de9..eabd1fa 100644
--- a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
+++ b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
@@ -406,6 +406,15 @@
 
         BufferInfo *outInfo = *outQueue.begin();
         OMX_BUFFERHEADERTYPE *outHeader = outInfo->mHeader;
+
+        if (outHeader->nOffset + encInfo.confSize > outHeader->nAllocLen) {
+            ALOGE("b/34617444");
+            android_errorWriteLog(0x534e4554,"34617444");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         outHeader->nFilledLen = encInfo.confSize;
         outHeader->nFlags = OMX_BUFFERFLAG_CODECCONFIG;