Add VPX output buffer size check

and handle dead observers more gracefully

Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518

diff --git a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
index 4cf3d4f..2178e5b 100644 (file)
--- a/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
+++ b/media/libstagefright/codecs/on2/dec/SoftVPX.cpp
@@ -147,15 +147,20 @@ void SoftVPX::onQueueFilled(OMX_U32 /* portIndex */) {
             outHeader->nFilledLen = (outputBufferWidth() * outputBufferHeight() * 3) / 2;
             outHeader->nFlags = EOSseen ? OMX_BUFFERFLAG_EOS : 0;
             outHeader->nTimeStamp = inHeader->nTimeStamp;
-
-            uint8_t *dst = outHeader->pBuffer;
-            const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];
-            const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
-            const uint8_t *srcV = (const uint8_t *)mImg->planes[VPX_PLANE_V];
-            size_t srcYStride = mImg->stride[VPX_PLANE_Y];
-            size_t srcUStride = mImg->stride[VPX_PLANE_U];
-            size_t srcVStride = mImg->stride[VPX_PLANE_V];
-            copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);
+            if (outHeader->nAllocLen >= outHeader->nFilledLen) {
+                uint8_t *dst = outHeader->pBuffer;
+                const uint8_t *srcY = (const uint8_t *)mImg->planes[VPX_PLANE_Y];
+                const uint8_t *srcU = (const uint8_t *)mImg->planes[VPX_PLANE_U];
+                const uint8_t *srcV = (const uint8_t *)mImg->planes[VPX_PLANE_V];
+                size_t srcYStride = mImg->stride[VPX_PLANE_Y];
+                size_t srcUStride = mImg->stride[VPX_PLANE_U];
+                size_t srcVStride = mImg->stride[VPX_PLANE_V];
+                copyYV12FrameToOutputBuffer(dst, srcY, srcU, srcV, srcYStride, srcUStride, srcVStride);
+            } else {
+                ALOGE("b/27597103, buffer too small");
+                android_errorWriteLog(0x534e4554, "27597103");
+                outHeader->nFilledLen = 0;
+            }
 
             mImg = NULL;
             outInfo->mOwnedByUs = false;

diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp
index 11b0d6d..f8a6f17 100644 (file)
--- a/media/libstagefright/omx/OMX.cpp
+++ b/media/libstagefright/omx/OMX.cpp
@@ -172,7 +172,12 @@ void OMX::binderDied(const wp<IBinder> &the_late_who) {
         Mutex::Autolock autoLock(mLock);
 
         ssize_t index = mLiveNodes.indexOfKey(the_late_who);
-        CHECK(index >= 0);
+
+        if (index < 0) {
+            ALOGE("b/27597103, nonexistent observer on binderDied");
+            android_errorWriteLog(0x534e4554, "27597103");
+            return;
+        }
 
         instance = mLiveNodes.editValueAt(index);
         mLiveNodes.removeItemsAt(index);