commit 11e9ddc2c14768ab73909231139a77897756d109
author android-build-team Robot <android-build-team-robot@google.com> Wed Aug 16 07:21:01 2017 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Wed Aug 16 07:21:01 2017 +0000
tree 4a39819c1208c763bd17e736c0355483fe6527fd
parent a2358fc58df0c1ab9a9b7f01da5a84ba2150371b
parent 7709475e7a034fc49fc999ce5671e07c31b977bf

release-request-447544c9-42cd-4c45-a7c6-4f09361c94db-for-git_oc-dr1-release-4277755 snap-temp-L90500000093605838

Change-Id: Iee0c88abe2424d6240d5e093c15577e3b9c10add

media/libstagefright/omx/SimpleSoftOMXComponent.cpp

diff --git a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
index 761b425..d89cb99 100644
--- a/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
+++ b/media/libstagefright/omx/SimpleSoftOMXComponent.cpp
@@ -214,6 +214,13 @@
     Mutex::Autolock autoLock(mLock);
     CHECK_LT(portIndex, mPorts.size());
 
+    PortInfo *port = &mPorts.editItemAt(portIndex);
+    if (size < port->mDef.nBufferSize) {
+        ALOGE("b/63522430, Buffer size is too small.");
+        android_errorWriteLog(0x534e4554, "63522430");
+        return OMX_ErrorBadParameter;
+    }
+
     *header = new OMX_BUFFERHEADERTYPE;
     (*header)->nSize = sizeof(OMX_BUFFERHEADERTYPE);
     (*header)->nVersion.s.nVersionMajor = 1;
@@ -236,8 +243,6 @@
     (*header)->nOutputPortIndex = portIndex;
     (*header)->nInputPortIndex = portIndex;
 
-    PortInfo *port = &mPorts.editItemAt(portIndex);
-
     CHECK(mState == OMX_StateLoaded || port->mDef.bEnabled == OMX_FALSE);
 
     CHECK_LT(port->mBuffers.size(), port->mDef.nBufferCountActual);