commit 5d44fff74dea989e51236d89b5ca19f37cae2ef3
author Marco Nelissen <marcone@google.com> Fri Mar 18 17:43:29 2016 +0000
committer android-build-merger <android-build-merger@google.com> Fri Mar 18 17:43:29 2016 +0000
tree 96063f84f1acbf70f0ab760e68b1831aed5c67f3
parent 50af72bcc5f5d84831d57333e64f439fcf125795
parent 1595f8ac7ab412e81e0565e1347edaeedf9f2832

DO NOT MERGE Add VPX output buffer size check
am: 1595f8a

* commit '1595f8ac7ab412e81e0565e1347edaeedf9f2832':
  DO NOT MERGE Add VPX output buffer size check

media/libstagefright/codecs/on2/dec/SoftVPX.cpp

diff --git a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
index 979a053..3934edc 100644
--- a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
+++ b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
@@ -155,31 +155,36 @@
             outHeader->nFlags = EOSseen ? OMX_BUFFERFLAG_EOS : 0;
             outHeader->nTimeStamp = inHeader->nTimeStamp;
 
-            const uint8_t *srcLine = (const uint8_t *)img->planes[VPX_PLANE_Y];
-            uint8_t *dst = outHeader->pBuffer;
-            for (size_t i = 0; i < img->d_h; ++i) {
-                memcpy(dst, srcLine, img->d_w);
+            if (outHeader->nAllocLen >= outHeader->nFilledLen) {
+                const uint8_t *srcLine = (const uint8_t *)img->planes[VPX_PLANE_Y];
+                uint8_t *dst = outHeader->pBuffer;
+                for (size_t i = 0; i < img->d_h; ++i) {
+                    memcpy(dst, srcLine, img->d_w);
 
-                srcLine += img->stride[VPX_PLANE_Y];
-                dst += img->d_w;
+                    srcLine += img->stride[VPX_PLANE_Y];
+                    dst += img->d_w;
+                }
+
+                srcLine = (const uint8_t *)img->planes[VPX_PLANE_U];
+                for (size_t i = 0; i < img->d_h / 2; ++i) {
+                    memcpy(dst, srcLine, img->d_w / 2);
+
+                    srcLine += img->stride[VPX_PLANE_U];
+                    dst += img->d_w / 2;
+                }
+
+                srcLine = (const uint8_t *)img->planes[VPX_PLANE_V];
+                for (size_t i = 0; i < img->d_h / 2; ++i) {
+                    memcpy(dst, srcLine, img->d_w / 2);
+
+                    srcLine += img->stride[VPX_PLANE_V];
+                    dst += img->d_w / 2;
+                }
+            } else {
+                ALOGE("b/27597103, buffer too small");
+                android_errorWriteLog(0x534e4554, "27597103");
+                outHeader->nFilledLen = 0;
             }
-
-            srcLine = (const uint8_t *)img->planes[VPX_PLANE_U];
-            for (size_t i = 0; i < img->d_h / 2; ++i) {
-                memcpy(dst, srcLine, img->d_w / 2);
-
-                srcLine += img->stride[VPX_PLANE_U];
-                dst += img->d_w / 2;
-            }
-
-            srcLine = (const uint8_t *)img->planes[VPX_PLANE_V];
-            for (size_t i = 0; i < img->d_h / 2; ++i) {
-                memcpy(dst, srcLine, img->d_w / 2);
-
-                srcLine += img->stride[VPX_PLANE_V];
-                dst += img->d_w / 2;
-            }
-
             outInfo->mOwnedByUs = false;
             outQueue.erase(outQueue.begin());
             outInfo = NULL;

media/libstagefright/omx/OMX.cpp

diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp
index 415910a..1ddf356 100644
--- a/media/libstagefright/omx/OMX.cpp
+++ b/media/libstagefright/omx/OMX.cpp
@@ -170,7 +170,12 @@
         Mutex::Autolock autoLock(mLock);
 
         ssize_t index = mLiveNodes.indexOfKey(the_late_who);
-        CHECK(index >= 0);
+
+        if (index < 0) {
+            ALOGE("b/27597103, nonexistent observer on binderDied");
+            android_errorWriteLog(0x534e4554, "27597103");
+            return;
+        }
 
         instance = mLiveNodes.editValueAt(index);
         mLiveNodes.removeItemsAt(index);