commit b5ce7ae2857d0ab1767244b9f212f5f3799f5aba
author Wei Jia <wjia@google.com> Fri Mar 25 11:24:28 2016 -0700
committer Wei Jia <wjia@google.com> Fri Mar 25 14:20:12 2016 -0700
tree 4ad76966bb6520ed4c696e0c51c74a99e6ef81b0
parent 9ce67b524236db52eadf558e7765775acad89f1f

SoftVorbis: fail gracefully when hitting invalid parameter.

Bug: 27843650
Change-Id: I0150414854da6a5e61bc13f5cb5ff470b8e35894

media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp

diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 41d9d55..6a689c4 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -338,7 +338,13 @@
             }
 
             if (inHeader->nFilledLen || !mSawInputEos) {
-                CHECK_GE(inHeader->nFilledLen, sizeof(numPageSamples));
+                if (inHeader->nFilledLen < sizeof(numPageSamples)) {
+                    notify(OMX_EventError, OMX_ErrorBadParameter, 0, NULL);
+                    mSignalledError = true;
+                    ALOGE("onQueueFilled, input header has nFilledLen %u, expected %zu",
+                            inHeader->nFilledLen, sizeof(numPageSamples));
+                    return;
+                }
                 memcpy(&numPageSamples,
                        inHeader->pBuffer
                         + inHeader->nOffset + inHeader->nFilledLen - 4,