commit b6bf46944fb0a2f14b3265559ad762d691b2a9ba
author Ray Essick <essick@google.com> Fri May 12 17:48:28 2017 +0000
committer android-build-merger <android-build-merger@google.com> Fri May 12 17:48:28 2017 +0000
tree 444c63318d4227284d46c1b59494a1af9bd33756
parent 2f72b15892e1e0ac04ec8bd7e757c22f69bc9fb8
parent 97db64baf6d61e6ac25566e72b0f7185a19e3859

Prevent OOB write in soft_avc encoder am: 463452a949
am: 97db64baf6

Change-Id: Ia77a7a995dab5a20d1757ab36d0dda680946274b

media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp

diff --git a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
index e4e8fd7..07d1245 100644
--- a/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
+++ b/media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp
@@ -611,6 +611,7 @@
     IV_STATUS_T status;
     WORD32 level;
     uint32_t displaySizeY;
+
     CHECK(!mStarted);
 
     OMX_ERRORTYPE errType = OMX_ErrorNone;
@@ -914,6 +915,9 @@
         }
     }
 
+    // clear other pointers into the space being free()d
+    mCodecCtx = NULL;
+
     mStarted = false;
 
     return OMX_ErrorNone;
@@ -1445,6 +1449,14 @@
     return;
 }
 
+void SoftAVC::onReset() {
+    SoftVideoEncoderOMXComponent::onReset();
+
+    if (releaseEncoder() != OMX_ErrorNone) {
+        ALOGW("releaseEncoder failed");
+    }
+}
+
 }  // namespace android
 
 android::SoftOMXComponent *createSoftOMXComponent(

media/libstagefright/codecs/avcenc/SoftAVCEnc.h

diff --git a/media/libstagefright/codecs/avcenc/SoftAVCEnc.h b/media/libstagefright/codecs/avcenc/SoftAVCEnc.h
index 4418a7f..77aca9b 100644
--- a/media/libstagefright/codecs/avcenc/SoftAVCEnc.h
+++ b/media/libstagefright/codecs/avcenc/SoftAVCEnc.h
@@ -137,6 +137,8 @@
 protected:
     virtual ~SoftAVC();
 
+    virtual void onReset();
+
 private:
     enum {
         kNumBuffers = 2,