commit 69f360e8f1517abfc298a3d6c7252c72269dc6c6
author Lajos Molnar <lajos@google.com> Mon Apr 23 13:50:17 2018 -0700
committer Lajos Molnar <lajos@google.com> Mon Apr 23 13:52:28 2018 -0700
tree 256b49917b166b5ab82452ec277a54fc247cb48e
parent 13c2b9b5b69fc045525193b441b6901d73a4b252

stagefright: null-terminate vendor OMX string extensions

Bug: 78233809
Change-Id: I3a14d96a1b4582da162fc37be4bf5dd6f5fe30bd

media/libstagefright/ACodec.cpp

diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp
index 0296dd8..ad81f04 100644
--- a/media/libstagefright/ACodec.cpp
+++ b/media/libstagefright/ACodec.cpp
@@ -7615,8 +7615,10 @@
                 config->param[paramIndex].bSet =
                     (OMX_BOOL)params->findString(existingKey->second.c_str(), &value);
                 if (config->param[paramIndex].bSet) {
-                    strncpy((char *)config->param[paramIndex].cString, value.c_str(),
-                            sizeof(OMX_CONFIG_ANDROID_VENDOR_PARAMTYPE::cString));
+                    size_t dstSize = sizeof(config->param[paramIndex].cString);
+                    strncpy((char *)config->param[paramIndex].cString, value.c_str(), dstSize - 1);
+                    // null terminate value
+                    config->param[paramIndex].cString[dstSize - 1] = '\0';
                 }
                 break;
             }