| commit | b95005cd34ed98c03350ff09666ab4f0b309752f | [log] [tgz] |
|---|---|---|
| author | Wonsik Kim <wonsik@google.com> | Mon Jul 08 22:19:33 2024 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Mon Jul 08 22:19:33 2024 +0000 |
| tree | 56e093f92477df42925c108332e821b356aa590c | |
| parent | 7c0613fc87eb1059d2bc41bd30c5dced6048c717 [diff] | |
| parent | 25b7cc780a750a89dcd82d728f879db95bd7ca37 [diff] |
omx: check HDR10+ info param size am: f816148a71 am: cc57ee47c6 am: 4b693c0a2c am: dd41492a2b am: 25b7cc780a Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/28105102 Change-Id: I5e371031a17838b004bac5fcede1f85da826e2b6 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp index 4183023..4ab5d10 100644 --- a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp +++ b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp
@@ -619,6 +619,13 @@ if (!isValidOMXParam(outParams)) { return OMX_ErrorBadParameter; } + if (offsetof(DescribeHDR10PlusInfoParams, nValue) + outParams->nParamSize > + outParams->nSize) { + ALOGE("b/329641908: too large param size; nParamSize=%u nSize=%u", + outParams->nParamSize, outParams->nSize); + android_errorWriteLog(0x534e4554, "329641908"); + return OMX_ErrorBadParameter; + } outParams->nParamSizeUsed = info->size();