Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a memory corruption problem in software M4v/H263 decoder due to out-of-scope local variable

Browse Source
This commit is contained in:
James Dong
2009-12-18 18:40:43 -08:00
parent 05de7c882e
commit 4e4795c8c0
3 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
media/libstagefright/OMXCodec.cpp
View File

@@ -123,11 +123,11 @@ static const CodecInfo kDecoderInfo[] = {
{ MEDIA_MIMETYPE_AUDIO_AAC, "OMX.PV.aacdec" }, { MEDIA_MIMETYPE_AUDIO_AAC, "OMX.PV.aacdec" },
{ MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.qcom.video.decoder.mpeg4" }, { MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.qcom.video.decoder.mpeg4" },
{ MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.TI.Video.Decoder" }, { MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.TI.Video.Decoder" },
OPTIONAL(MEDIA_MIMETYPE_VIDEO_MPEG4, "M4vH264Decoder") OPTIONAL(MEDIA_MIMETYPE_VIDEO_MPEG4, "M4vH263Decoder")
{ MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.PV.mpeg4dec" }, { MEDIA_MIMETYPE_VIDEO_MPEG4, "OMX.PV.mpeg4dec" },
{ MEDIA_MIMETYPE_VIDEO_H263, "OMX.qcom.video.decoder.h263" }, { MEDIA_MIMETYPE_VIDEO_H263, "OMX.qcom.video.decoder.h263" },
{ MEDIA_MIMETYPE_VIDEO_H263, "OMX.TI.Video.Decoder" }, { MEDIA_MIMETYPE_VIDEO_H263, "OMX.TI.Video.Decoder" },
OPTIONAL(MEDIA_MIMETYPE_VIDEO_H263, "M4vH264Decoder") OPTIONAL(MEDIA_MIMETYPE_VIDEO_H263, "M4vH263Decoder")
{ MEDIA_MIMETYPE_VIDEO_H263, "OMX.PV.h263dec" }, { MEDIA_MIMETYPE_VIDEO_H263, "OMX.PV.h263dec" },
{ MEDIA_MIMETYPE_VIDEO_AVC, "OMX.qcom.video.decoder.avc" }, { MEDIA_MIMETYPE_VIDEO_AVC, "OMX.qcom.video.decoder.avc" },
{ MEDIA_MIMETYPE_VIDEO_AVC, "OMX.TI.Video.Decoder" }, { MEDIA_MIMETYPE_VIDEO_AVC, "OMX.TI.Video.Decoder" },

18
media/libstagefright/codecs/m4v_h263/dec/M4vH263Decoder.cpp
View File

@@ -13,8 +13,9 @@
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
#define LOG_NDEBUG 0 //#define LOG_NDEBUG 0
#define LOG_TAG "M4vH263Decoder" #define LOG_TAG "M4vH263Decoder"
#include <utils/Log.h>
#include "ESDS.h" #include "ESDS.h"
#include "M4vH263Decoder.h" #include "M4vH263Decoder.h"
@@ -37,8 +38,9 @@ M4vH263Decoder::M4vH263Decoder(const sp<MediaSource> &source)
mHandle(new tagvideoDecControls), mHandle(new tagvideoDecControls),
mInputBuffer(NULL), mInputBuffer(NULL),
mNumSamplesOutput(0) { mNumSamplesOutput(0) {
memset(mHandle, 0, sizeof(tagvideoDecControls));
LOGV("M4vH263Decoder");
memset(mHandle, 0, sizeof(tagvideoDecControls));
mFormat = new MetaData; mFormat = new MetaData;
mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_RAW); mFormat->setCString(kKeyMIMEType, MEDIA_MIMETYPE_VIDEO_RAW);
CHECK(mSource->getFormat()->findInt32(kKeyWidth, &mWidth)); CHECK(mSource->getFormat()->findInt32(kKeyWidth, &mWidth));
@@ -47,7 +49,6 @@ M4vH263Decoder::M4vH263Decoder(const sp<MediaSource> &source)
mFormat->setInt32(kKeyHeight, mHeight); mFormat->setInt32(kKeyHeight, mHeight);
mFormat->setInt32(kKeyColorFormat, OMX_COLOR_FormatYUV420Planar); mFormat->setInt32(kKeyColorFormat, OMX_COLOR_FormatYUV420Planar);
mFormat->setCString(kKeyDecoderComponent, "M4vH263Decoder"); mFormat->setCString(kKeyDecoderComponent, "M4vH263Decoder");
} }
M4vH263Decoder::~M4vH263Decoder() { M4vH263Decoder::~M4vH263Decoder() {
@@ -76,7 +77,7 @@ status_t M4vH263Decoder::start(MetaData *) {
uint32_t type; uint32_t type;
const void *data = NULL; const void *data = NULL;
size_t size = 0; size_t size = 0;
uint8_t *vol_data = NULL; uint8_t *vol_data[1] = {0};
int32_t vol_size = 0; int32_t vol_size = 0;
if (mSource->getFormat()->findData(kKeyESDS, &type, &data, &size)) { if (mSource->getFormat()->findData(kKeyESDS, &type, &data, &size)) {
ESDS esds((const uint8_t *)data, size); ESDS esds((const uint8_t *)data, size);
@@ -86,14 +87,17 @@ status_t M4vH263Decoder::start(MetaData *) {
size_t codec_specific_data_size; size_t codec_specific_data_size;
esds.getCodecSpecificInfo(&codec_specific_data, &codec_specific_data_size); esds.getCodecSpecificInfo(&codec_specific_data, &codec_specific_data_size);
vol_data = (uint8_t *) codec_specific_data; vol_data[0] = (uint8_t *) malloc(codec_specific_data_size);
memcpy(vol_data[0], codec_specific_data, codec_specific_data_size);
vol_size = codec_specific_data_size; vol_size = codec_specific_data_size;
} else { } else {
vol_data = NULL; vol_data[0] = NULL;
vol_size = 0; vol_size = 0;
} }
CHECK_EQ(PV_TRUE, PVInitVideoDecoder( CHECK_EQ(PV_TRUE, PVInitVideoDecoder(
mHandle, &vol_data, &vol_size, 1, mWidth, mHeight, mode)); mHandle, vol_data, &vol_size, 1, mWidth, mHeight, mode));
if (vol_data[0]) free(vol_data[0]);
MP4DecodingMode actualMode = PVGetDecBitstreamMode(mHandle); MP4DecodingMode actualMode = PVGetDecBitstreamMode(mHandle);
CHECK_EQ(mode, actualMode); CHECK_EQ(mode, actualMode);

1
media/libstagefright/include/M4vH263Decoder.h
View File

@@ -45,7 +45,6 @@ protected:
private: private:
sp<MediaSource> mSource; sp<MediaSource> mSource;
bool mStarted; bool mStarted;
bool mInitialized;
int32_t mWidth, mHeight; int32_t mWidth, mHeight;
sp<MetaData> mFormat; sp<MetaData> mFormat;