Merge "SoftOpus: fix out of bounds access"
diff --git a/media/libstagefright/codecs/opus/dec/SoftOpus.cpp b/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
index 942f850..c6dc326 100644
--- a/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
+++ b/media/libstagefright/codecs/opus/dec/SoftOpus.cpp
@@ -430,6 +430,15 @@
return;
}
+ if (size < sizeof(int64_t)) {
+ // The 2nd and 3rd input buffer are expected to contain
+ // an int64_t (see below), so make sure we get at least
+ // that much. The first input buffer must contain 19 bytes,
+ // but that is checked already.
+ notify(OMX_EventError, OMX_ErrorUndefined, 0, NULL);
+ return;
+ }
+
if (mInputBufferCount == 0) {
delete mHeader;
mHeader = new OpusHeader();