commit 8abf11b512f7da119a04edbb152955bc5166e310
author Ray Essick <essick@google.com> Mon Mar 13 22:52:42 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Mar 13 22:52:42 2017 +0000
tree bae5419d142ac93e7b48f2f6dc623a8d91f0e590
parent c3de266a990055c3764c9137a43da99a09d75ccc
parent 5b1bfc1f43b1341b462868fdaa8a2d74da5d2714

Merge "Add bounds check in SoftAACEncoder2::onQueueFilled()" into klp-dev am: 19b91af752 am: 8e3cf4d841
am: 5b1bfc1f43

Change-Id: I32327162d3e69259656f0b3a82800f45572527fd

media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp

diff --git a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
index a714586..8a7a5cc 100644
--- a/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
+++ b/media/libstagefright/codecs/aacenc/SoftAACEncoder2.cpp
@@ -479,6 +479,15 @@
 
         BufferInfo *outInfo = *outQueue.begin();
         OMX_BUFFERHEADERTYPE *outHeader = outInfo->mHeader;
+
+        if (outHeader->nOffset + encInfo.confSize > outHeader->nAllocLen) {
+            ALOGE("b/34617444");
+            android_errorWriteLog(0x534e4554,"34617444");
+            notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+            mSignalledError = true;
+            return;
+        }
+
         outHeader->nFilledLen = encInfo.confSize;
         outHeader->nFlags = OMX_BUFFERFLAG_CODECCONFIG;