Permalink
Browse files

Promotion of audio-userspace.lnx.2.1.c1-00031.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
2013236   I0e1f75ea307088b92e87b99f8b614afbcd0f1c82   aenc-aac: bounds checking

Change-Id: I00436502ea0a88fbcf342a4d6d16bb2a39d244ef
CRs-Fixed: 2013236
  • Loading branch information...
Linux Build Service Account
Linux Build Service Account committed May 23, 2017
2 parents 39da5cc + bcd773f commit d40705f1fcd333f8e8115dd69555f9e9facfa78c
Showing with 16 additions and 5 deletions.
  1. +16 −5 mm-audio/aenc-aac/qdsp6/src/omx_aac_aenc.cpp
@@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.
Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
@@ -4178,14 +4178,25 @@ OMX_ERRORTYPE omx_aac_aenc::fill_this_buffer_proxy
DEBUG_DETAIL("FTBP->Al_len[%lu]buf[%p]size[%d]numOutBuf[%d]\n",\
buffer->nAllocLen,m_tmp_out_meta_buf,
nReadbytes,nNumOutputBuf);
if(*m_tmp_out_meta_buf <= 0)
if(m_tmp_out_meta_buf == NULL)
return OMX_ErrorUndefined;
if(*m_tmp_out_meta_buf <= 0 || *m_tmp_out_meta_buf > CHAR_MAX)
return OMX_ErrorBadParameter;
szadifhr = AUDAAC_MAX_ADIF_HEADER_LENGTH;
szadifhr = AUDAAC_MAX_ADIF_HEADER_LENGTH;
numframes = *m_tmp_out_meta_buf;
metainfo = (int)((sizeof(ENC_META_OUT) * numframes)+
sizeof(unsigned char));
sizeof(unsigned char));
/*
* add bounds checking
*/
if ((metainfo > INT_MAX - szadifhr) ||
(buffer->nAllocLen < (nReadbytes + szadifhr)) ||
(metainfo > nReadbytes)) {
return OMX_ErrorBadParameter;
}
audaac_rec_install_adif_header_variable(0,sample_idx,
(OMX_U8)m_aac_param.nChannels);
(OMX_U8)m_aac_param.nChannels);
memcpy(buffer->pBuffer,m_tmp_out_meta_buf,metainfo);
memcpy(buffer->pBuffer + metainfo,&audaac_header_adif[0],szadifhr);
memcpy(buffer->pBuffer + metainfo + szadifhr,

0 comments on commit d40705f

Please sign in to comment.