commit 149c0cb8048c9a21fa3e04b8071e544b0c3824c6
author The Android Automerger <android-build@google.com> Tue Dec 15 12:54:55 2015 -0800
committer The Android Automerger <android-build@google.com> Tue Dec 15 12:54:55 2015 -0800
tree 07423dde85b3439ea496f4c16cb377feef8d72af
parent 5dc9ffe50ef517591b8ffad66c7e4d6ec82b8b4b
parent 7b461b52966265b7b55f723c22fa02fac32a8709

merge in mnc-mr1-release history after reset to mnc-dr-dev

media/libmedia/ICrypto.cpp

diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 22f8af7..a398ff7 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -321,9 +321,7 @@
 
             if (overflow || sumSubsampleSizes != totalSize) {
                 result = -EINVAL;
-            } else if (totalSize > sharedBuffer->size()) {
-                result = -EINVAL;
-            } else if ((size_t)offset > sharedBuffer->size() - totalSize) {
+            } else if (offset + totalSize > sharedBuffer->size()) {
                 result = -EINVAL;
             } else {
                 result = decrypt(

media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp

diff --git a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp
index f2a4e65..8240f83 100644
--- a/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp
+++ b/media/libstagefright/codecs/m4v_h263/enc/SoftMPEG4Encoder.cpp
@@ -37,10 +37,6 @@
 
 #include <inttypes.h>
 
-#ifndef INT32_MAX
-#define INT32_MAX   2147483647
-#endif
-
 namespace android {
 
 template<class T>
@@ -141,11 +137,6 @@
     if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) {
         // Color conversion is needed.
         free(mInputFrameData);
-        mInputFrameData = NULL;
-        if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) {
-            ALOGE("b/25812794, Buffer size is too big.");
-            return OMX_ErrorBadParameter;
-        }
         mInputFrameData =
             (uint8_t *) malloc((mWidth * mHeight * 3 ) >> 1);
         CHECK(mInputFrameData != NULL);

media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp

diff --git a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp
index 410f9d0..e654843 100644
--- a/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp
+++ b/media/libstagefright/codecs/on2/enc/SoftVPXEncoder.cpp
@@ -26,10 +26,6 @@
 #include <media/stagefright/foundation/ADebug.h>
 #include <media/stagefright/MediaDefs.h>
 
-#ifndef INT32_MAX
-#define INT32_MAX   2147483647
-#endif
-
 namespace android {
 
 template<class T>
@@ -319,11 +315,6 @@
 
     if (mColorFormat != OMX_COLOR_FormatYUV420Planar || mInputDataIsMeta) {
         free(mConversionBuffer);
-        mConversionBuffer = NULL;
-        if (((uint64_t)mWidth * mHeight) > ((uint64_t)INT32_MAX / 3)) {
-            ALOGE("b/25812794, Buffer size is too big.");
-            return UNKNOWN_ERROR;
-        }
         mConversionBuffer = (uint8_t *)malloc(mWidth * mHeight * 3 / 2);
         if (mConversionBuffer == NULL) {
             ALOGE("Allocating conversion buffer failed.");