commit 56c95c9bee23aec674348e06c4385e63ac6123bc
author Wei Jia <wjia@google.com> Wed Jan 06 10:30:46 2016 -0800
committer Wei Jia <wjia@google.com> Wed Jan 06 22:10:51 2016 +0000
tree 494dea3a4028b7be2645d13268302b84667404c0
parent 454cb283bb01ba5748a2660d983985ee08418fc8

IOMX: check parameters on binder receiver side.

Bug: 26392700
Change-Id: I92c93718bbc1bcb366a051af3bdfbbe06c8701e6

media/libmedia/IOMX.cpp

diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 5423c2a..550b506 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -642,6 +642,12 @@
             sp<IOMXObserver> observer =
                 interface_cast<IOMXObserver>(data.readStrongBinder());
 
+            if (name == NULL || observer == NULL) {
+                ALOGE("b/26392700");
+                reply->writeInt32(INVALID_OPERATION);
+                return NO_ERROR;
+            }
+
             node_id node;
 
             status_t err = allocateNode(name, observer, &node);
@@ -787,6 +793,12 @@
                 interface_cast<IMemory>(data.readStrongBinder());
             OMX_U32 allottedSize = data.readInt32();
 
+            if (params == NULL) {
+                ALOGE("b/26392700");
+                reply->writeInt32(INVALID_OPERATION);
+                return NO_ERROR;
+            }
+
             buffer_id buffer;
             status_t err = useBuffer(node, port_index, params, &buffer, allottedSize);
             reply->writeInt32(err);
@@ -886,8 +898,13 @@
             sp<IGraphicBufferConsumer> bufferConsumer =
                     interface_cast<IGraphicBufferConsumer>(data.readStrongBinder());
 
-            MetadataBufferType type;
-            status_t err = setInputSurface(node, port_index, bufferConsumer, &type);
+            MetadataBufferType type = kMetadataBufferTypeInvalid;
+            status_t err = INVALID_OPERATION;
+            if (bufferConsumer == NULL) {
+                ALOGE("b/26392700");
+            } else {
+                err = setInputSurface(node, port_index, bufferConsumer, &type);
+            }
 
             reply->writeInt32(type);
             reply->writeInt32(err);
@@ -995,6 +1012,12 @@
                 interface_cast<IMemory>(data.readStrongBinder());
             OMX_U32 allottedSize = data.readInt32();
 
+            if (params == NULL) {
+                ALOGE("b/26392700");
+                reply->writeInt32(INVALID_OPERATION);
+                return NO_ERROR;
+            }
+
             buffer_id buffer;
             status_t err = allocateBufferWithBackup(
                     node, port_index, params, &buffer, allottedSize);
@@ -1058,6 +1081,12 @@
             node_id node = (node_id)data.readInt32();
             const char *parameter_name = data.readCString();
 
+            if (parameter_name == NULL) {
+                ALOGE("b/26392700");
+                reply->writeInt32(INVALID_OPERATION);
+                return NO_ERROR;
+            }
+
             OMX_INDEXTYPE index;
             status_t err = getExtensionIndex(node, parameter_name, &index);