mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
76 lines
2.7 KiB
Diff
76 lines
2.7 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Ray Essick <essick@google.com>
|
|
Date: Mon, 27 Mar 2023 18:16:46 -0500
|
|
Subject: [PATCH] Fix NuMediaExtractor::readSampleData buffer Handling
|
|
|
|
readSampleData() did not initialize buffer before filling it,
|
|
leading to OOB memory references. Correct and clarify the book
|
|
keeping around output buffer management.
|
|
|
|
Bug: 275418191
|
|
Test: CtsMediaExtractorTestCases w/debug messages
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:943fc12219b21d2a98f0ddc070b9b316a6f5d412)
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:84c69bca81175feb2fd97ebb22e432ee41572786)
|
|
Merged-In: Ie744f118526f100d82a312c64f7c6fcf20773b6d
|
|
Change-Id: Ie744f118526f100d82a312c64f7c6fcf20773b6d
|
|
---
|
|
media/libstagefright/NuMediaExtractor.cpp | 14 +++++++++-----
|
|
1 file changed, 9 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/media/libstagefright/NuMediaExtractor.cpp b/media/libstagefright/NuMediaExtractor.cpp
|
|
index 640cb82282..1fad9301da 100644
|
|
--- a/media/libstagefright/NuMediaExtractor.cpp
|
|
+++ b/media/libstagefright/NuMediaExtractor.cpp
|
|
@@ -484,9 +484,11 @@ status_t NuMediaExtractor::appendVorbisNumPageSamples(TrackInfo *info, const sp<
|
|
numPageSamples = -1;
|
|
}
|
|
|
|
+ // insert, including accounting for the space used.
|
|
memcpy((uint8_t *)buffer->data() + info->mSample->range_length(),
|
|
&numPageSamples,
|
|
sizeof(numPageSamples));
|
|
+ buffer->setRange(buffer->offset(), buffer->size() + sizeof(numPageSamples));
|
|
|
|
uint32_t type;
|
|
const void *data;
|
|
@@ -535,6 +537,8 @@ status_t NuMediaExtractor::readSampleData(const sp<ABuffer> &buffer) {
|
|
|
|
ssize_t minIndex = fetchTrackSamples();
|
|
|
|
+ buffer->setRange(0, 0); // start with an empty buffer
|
|
+
|
|
if (minIndex < 0) {
|
|
return ERROR_END_OF_STREAM;
|
|
}
|
|
@@ -549,25 +553,25 @@ status_t NuMediaExtractor::readSampleData(const sp<ABuffer> &buffer) {
|
|
sampleSize += sizeof(int32_t);
|
|
}
|
|
|
|
+ // capacity() is ok since we cleared out the buffer
|
|
if (buffer->capacity() < sampleSize) {
|
|
return -ENOMEM;
|
|
}
|
|
|
|
+ const size_t srclen = info->mSample->range_length();
|
|
const uint8_t *src =
|
|
(const uint8_t *)info->mSample->data()
|
|
+ info->mSample->range_offset();
|
|
|
|
- memcpy((uint8_t *)buffer->data(), src, info->mSample->range_length());
|
|
+ memcpy((uint8_t *)buffer->data(), src, srclen);
|
|
+ buffer->setRange(0, srclen);
|
|
|
|
status_t err = OK;
|
|
if (info->mTrackFlags & kIsVorbis) {
|
|
+ // adjusts range when it inserts the extra bits
|
|
err = appendVorbisNumPageSamples(info, buffer);
|
|
}
|
|
|
|
- if (err == OK) {
|
|
- buffer->setRange(0, sampleSize);
|
|
- }
|
|
-
|
|
return err;
|
|
}
|
|
|