commit c448c4980afd0b6d3d9dbb08ab25dd0459a0fe37
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Nov 12 05:36:37 2021 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Nov 12 05:36:37 2021 +0000
tree 65db78ca8cb670510dfb74dab56160cd64ea468c
parent 5cb599bea705585a302a1c589e710e4b98400591
parent 2090bfce7cb7e9f7193b3dbdc6463e254c179d80

Merge cherrypicks of [16187628] into security-aosp-pi-release.

Change-Id: Ic3bed4ae9bab164293fe89fca04ae6428a025dad

media/libstagefright/SimpleDecodingSource.cpp

diff --git a/media/libstagefright/SimpleDecodingSource.cpp b/media/libstagefright/SimpleDecodingSource.cpp
index 404c537..539e461 100644
--- a/media/libstagefright/SimpleDecodingSource.cpp
+++ b/media/libstagefright/SimpleDecodingSource.cpp
@@ -317,18 +317,23 @@
                 }
                 size_t cpLen = min(in_buf->range_length(), in_buffer->capacity());
                 memcpy(in_buffer->base(), (uint8_t *)in_buf->data() + in_buf->range_offset(),
-                        cpLen );
+                        cpLen);
 
                 if (mIsVorbis) {
                     int32_t numPageSamples;
                     if (!in_buf->meta_data().findInt32(kKeyValidSamples, &numPageSamples)) {
                         numPageSamples = -1;
                     }
-                    memcpy(in_buffer->base() + cpLen, &numPageSamples, sizeof(numPageSamples));
+                    if (cpLen + sizeof(numPageSamples) <= in_buffer->capacity()) {
+                        memcpy(in_buffer->base() + cpLen, &numPageSamples, sizeof(numPageSamples));
+                        cpLen += sizeof(numPageSamples);
+                    } else {
+                        ALOGW("Didn't have enough space to copy kKeyValidSamples");
+                    }
                 }
 
                 res = mCodec->queueInputBuffer(
-                        in_ix, 0 /* offset */, in_buf->range_length() + (mIsVorbis ? 4 : 0),
+                        in_ix, 0 /* offset */, cpLen,
                         timestampUs, 0 /* flags */);
                 if (res != OK) {
                     ALOGI("[%s] failed to queue input buffer #%zu", mComponentName.c_str(), in_ix);