commit d4b3c84375bf6dde20e853e65c775ed6c932ae86
author Marco Nelissen <marcone@google.com> Fri Jan 06 13:57:51 2017 -0800
committer Feng Yu <feny@google.com> Fri Jan 20 00:44:15 2017 +0000
tree 647c905b0f2ab91b44db5000fe948c6730d30029
parent 523fd3c5da4c137a2f5002e8ba2b9b2691e4d3ad

Don't CHECK when buffer is too large

Bug: 31647370
Test: ran CTS test with and without patch
Change-Id: I4e3a37aabc9387432671c1c0c469241142612cc4
(cherry picked from commit c2f0c73bfcf36219f446e3eef9effe49a3a415a5)

media/libstagefright/OMXCodec.cpp

diff --git a/media/libstagefright/OMXCodec.cpp b/media/libstagefright/OMXCodec.cpp
index 7e15e18..9774ae0 100644
--- a/media/libstagefright/OMXCodec.cpp
+++ b/media/libstagefright/OMXCodec.cpp
@@ -2851,7 +2851,11 @@
             static const uint8_t kNALStartCode[4] =
                     { 0x00, 0x00, 0x00, 0x01 };
 
-            CHECK(info->mSize >= specific->mSize + 4);
+            if (info->mSize < specific->mSize + 4) {
+                ALOGE("info size %zu < specific size %zu", info->mSize, specific->mSize + 4);
+                setState(ERROR);
+                return false;
+            }
 
             size += 4;
 
@@ -2859,7 +2863,11 @@
             memcpy((uint8_t *)info->mData + 4,
                    specific->mData, specific->mSize);
         } else {
-            CHECK(info->mSize >= specific->mSize);
+            if (info->mSize < specific->mSize) {
+                ALOGE("info size %zu < specific size %zu", info->mSize, specific->mSize);
+                setState(ERROR);
+                return false;
+            }
             memcpy(info->mData, specific->mData, specific->mSize);
         }