commit 576a46e9c141a021fb050c1fd240f95e4bdacc9b
author Marco Nelissen <marcone@google.com> Wed Mar 23 15:36:36 2016 -0700
committer The Android Automerger <android-build@google.com> Thu Apr 21 20:08:13 2016 -0700
tree 443635955497f7b71ef32c2e289476620c2e961f
parent 4558a32ce3b78c6a4da18e546de5f361a9239510

Check mp3 output buffer size

Bug: 27793371
Change-Id: I0fe40a4cfd0a5b488f93d3f3ba6f9495235926ac

media/libstagefright/codecs/mp3dec/SoftMP3.cpp

diff --git a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
index 9988015..aa946e6 100644
--- a/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
+++ b/media/libstagefright/codecs/mp3dec/SoftMP3.cpp
@@ -263,6 +263,14 @@
         mConfig->inputBufferUsedLength = 0;
 
         mConfig->outputFrameSize = kOutputBufferSize / sizeof(int16_t);
+        if ((int32)outHeader->nAllocLen < mConfig->outputFrameSize) {
+            ALOGE("input buffer too small: got %lu, expected %u",
+                outHeader->nAllocLen, mConfig->outputFrameSize);
+            android_errorWriteLog(0x534e4554, "27793371");
+            notify(OMX_EventError, OMX_ErrorUndefined, OUTPUT_BUFFER_TOO_SMALL, NULL);
+            mSignalledError = true;
+            return;
+        }
 
         mConfig->pOutputBuffer =
             reinterpret_cast<int16_t *>(outHeader->pBuffer);