commit 7b0b51c33721f694803ed57c2a5dbd0faf55206a
author Ray Essick <essick@google.com> Mon Mar 13 23:42:51 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Mar 13 23:42:51 2017 +0000
tree 829b85bb83df50c99dc67d4f6d6dff8686005ee7
parent bb8e18154d451238394d8c8c0a800c5381f37023
parent 530cf7afef16eacfa6ff5290ab3fb6b46631c2f8

Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752 am: 8e3cf4d841 am: 5b1bfc1f43 am: 8abf11b512 am: 4bc4f78933 am: 7f2592fe4a am: dbdf026f76 am: c4305aeda4 am: 1baad9ad99 am: 2ad7f9b172 am: 457bde5e35 am: ed1109257a am: 9ab3187ff5
am: 530cf7afef

Change-Id: I3ded31b95bff54d255eed96d7e6e1ccd083468f4

media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp

diff --git a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
index c55d536..44415e2 100644
--- a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
+++ b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
@@ -512,6 +512,15 @@
 
         BufferInfo *outInfo = *outQueue.begin();
         OMX_BUFFERHEADERTYPE *outHeader = outInfo->mHeader;
+
+        if (outHeader->nOffset + encInfo.confSize > outHeader->nAllocLen) {
+            ALOGE("b/34617444");
+            android_errorWriteLog(0x534e4554,"34617444");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         outHeader->nFilledLen = encInfo.confSize;
         outHeader->nFlags = OMX_BUFFERFLAG_CODECCONFIG;