diff options
| author | Wonsik Kim <wonsik@google.com> | 2024-06-28 00:33:51 +0000 |
|---|---|---|
| committer | Julian Veit <claymore1298@gmail.com> | 2024-10-27 10:03:42 +0100 |
| commit | e3a790acb566eb40dd491ee22a17018714659a2b (patch) | |
| tree | 924da34a4148a23d252be0999186bcfb26e6d22b | |
| parent | 0d34d9c9a2cf2d7d76bae5df0bf25798c3f8f140 (diff) | |
omx: check HDR10+ info param sizes12.1
Bug: 329641908
Test: presubmit
Flag: EXEMPT security fix
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:53298956ba6bb8f147a632d7aaed8566dfc203ee)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f816148a719d2a3bbf432f11da98b3d5fa7de74f)
Merged-In: I72523e1de61e5f947174272b732e170e1c2964df
Change-Id: I72523e1de61e5f947174272b732e170e1c2964df
| -rw-r--r-- | media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp index 418302389d..4ab5d10609 100644 --- a/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp +++ b/media/libstagefright/omx/SoftVideoDecoderOMXComponent.cpp @@ -619,6 +619,13 @@ OMX_ERRORTYPE SoftVideoDecoderOMXComponent::getConfig( if (!isValidOMXParam(outParams)) { return OMX_ErrorBadParameter; } + if (offsetof(DescribeHDR10PlusInfoParams, nValue) + outParams->nParamSize > + outParams->nSize) { + ALOGE("b/329641908: too large param size; nParamSize=%u nSize=%u", + outParams->nParamSize, outParams->nSize); + android_errorWriteLog(0x534e4554, "329641908"); + return OMX_ErrorBadParameter; + } outParams->nParamSizeUsed = info->size(); |