Check buffer size in useBuffer in software components Test: No more crash from oob read/write with running poc. Bug: 63522430 Change-Id: I232d256eacdfaa9347902fe9b42650999f0d2d85 (cherry picked from commit 4e79910fdb303fd28a37a9401bed1b7fbccb1373)
diff --git a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp index 13afd45..a391911 100644 --- a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp +++ b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
@@ -199,6 +199,13 @@ Mutex::Autolock autoLock(mLock); CHECK_LT(portIndex, mPorts.size()); + PortInfo *port = &mPorts.editItemAt(portIndex); + if (size < port->mDef.nBufferSize) { + ALOGE("b/63522430, Buffer size is too small."); + android_errorWriteLog(0x534e4554, "63522430"); + return OMX_ErrorBadParameter; + } + *header = new OMX_BUFFERHEADERTYPE; (*header)->nSize = sizeof(OMX_BUFFERHEADERTYPE); (*header)->nVersion.s.nVersionMajor = 1; @@ -221,8 +228,6 @@ (*header)->nOutputPortIndex = portIndex; (*header)->nInputPortIndex = portIndex; - PortInfo *port = &mPorts.editItemAt(portIndex); - CHECK(mState == OMX_StateLoaded || port->mDef.bEnabled == OMX_FALSE); CHECK_LT(port->mBuffers.size(), port->mDef.nBufferCountActual);