commit f80a1f5075a7c6e1982d37c68bfed7c9a611bb20
author Wei Jia <wjia@google.com> Tue Sep 13 16:50:07 2016 -0700
committer Wei Jia <wjia@google.com> Thu Sep 15 20:20:10 2016 +0000
tree f2f4ec2ed2550b52137e9f1f74bf8410510ee81c
parent 5ee5d852d1377fe7b0c34d0d67c24643144a0a50

OMXNodeInstance: sanity check portIndex.

Bug: 31385713
Change-Id: Ib91d00eb5cc8c51c84d37f5d36d6b7ca594d201f

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index d121c17..f689eed 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -531,6 +531,12 @@
 
 status_t OMXNodeInstance::enableNativeBuffers(
         OMX_U32 portIndex, OMX_BOOL graphic, OMX_BOOL enable) {
+    if (portIndex >= NELEM(mSecureBufferType)) {
+        ALOGE("b/31385713, portIndex(%u)", portIndex);
+        android_errorWriteLog(0x534e4554, "31385713");
+        return BAD_VALUE;
+    }
+
     Mutex::Autolock autoLock(mLock);
     CLOG_CONFIG(enableNativeBuffers, "%s:%u%s, %d", portString(portIndex), portIndex,
                 graphic ? ", graphic" : "", enable);
@@ -1217,6 +1223,12 @@
         return BAD_VALUE;
     }
 
+    if (portIndex >= NELEM(mSecureBufferType)) {
+        ALOGE("b/31385713, portIndex(%u)", portIndex);
+        android_errorWriteLog(0x534e4554, "31385713");
+        return BAD_VALUE;
+    }
+
     Mutex::Autolock autoLock(mLock);
 
     BufferMeta *buffer_meta = new BufferMeta(size, portIndex);