commit f8f19fb46c4013445a650bfcf8d8ae21db09f16b
author Marco Nelissen <marcone@google.com> Mon Mar 27 15:04:25 2017 -0700
committer gitbuildkicker <android-build@google.com> Wed Apr 19 10:59:33 2017 -0700
tree 5bf445fe6882f021e26a3a4038c757dde906bf03
parent 0be0ed5a7c9d288f324675e80b0fca657570a8bf

Don't allow using or allocating a buffer after the first state transition

Bug: 35467458
Change-Id: Ia76c8cec8ad2abb95ca29b2a89075f7acab4b174
(cherry picked from commit e25320450ca414dd859fd5d80bcd18ecc91630de)

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 43a50ae..c3514b3 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -792,6 +792,12 @@
         return BAD_VALUE;
     }
 
+    if (!mSailed) {
+        ALOGE("b/35467458");
+        android_errorWriteLog(0x534e4554, "35467458");
+        return BAD_VALUE;
+    }
+
     // metadata buffers are not connected cross process
     // use a backup buffer instead of the actual buffer
     BufferMeta *buffer_meta;
@@ -1223,6 +1229,12 @@
 
     Mutex::Autolock autoLock(mLock);
 
+    if (!mSailed) {
+        ALOGE("b/35467458");
+        android_errorWriteLog(0x534e4554, "35467458");
+        return BAD_VALUE;
+    }
+
     BufferMeta *buffer_meta = new BufferMeta(size, portIndex);
 
     OMX_BUFFERHEADERTYPE *header;
@@ -1278,6 +1290,12 @@
         return BAD_VALUE;
     }
 
+    if (!mSailed) {
+        ALOGE("b/35467458");
+        android_errorWriteLog(0x534e4554, "35467458");
+        return BAD_VALUE;
+    }
+
     // metadata buffers are not connected cross process; only copy if not meta
     bool copy = mMetadataType[portIndex] == kMetadataBufferTypeInvalid;