commit 9a2be5d49d57b239bf6345f033eab01ba98f3889
author Abhishek Arya <aarya@google.com> Tue Aug 25 04:00:04 2015 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Aug 25 04:00:04 2015 +0000
tree e0417802932d787daf906e84938864898624c6be
parent a5f50e98d1408addcaaac27e4d13981163d12a15
parent 0f3e2daa1d56c98196a719a6e641f3ed67b8e7bf

Merge "DO NOT MERGE - Fix software video decoder buffer size calculation" into klp-dev

media/libstagefright/colorconversion/SoftwareRenderer.cpp

diff --git a/media/libstagefright/colorconversion/SoftwareRenderer.cpp b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
index 77f21b7..990d554 100644
--- a/media/libstagefright/colorconversion/SoftwareRenderer.cpp
+++ b/media/libstagefright/colorconversion/SoftwareRenderer.cpp
@@ -164,6 +164,9 @@
                 buf->stride, buf->height,
                 0, 0, mCropWidth - 1, mCropHeight - 1);
     } else if (mColorFormat == OMX_COLOR_FormatYUV420Planar) {
+        if ((size_t)mWidth * mHeight * 3 / 2 > size) {
+            goto skip_copying;
+        }
         const uint8_t *src_y = (const uint8_t *)data;
         const uint8_t *src_u = (const uint8_t *)data + mWidth * mHeight;
         const uint8_t *src_v = src_u + (mWidth / 2 * mHeight / 2);
@@ -193,6 +196,9 @@
         }
     } else {
         CHECK_EQ(mColorFormat, OMX_TI_COLOR_FormatYUV420PackedSemiPlanar);
+        if ((size_t)mWidth * mHeight * 3 / 2 > size) {
+            goto skip_copying;
+        }
 
         const uint8_t *src_y =
             (const uint8_t *)data;
@@ -228,6 +234,7 @@
         }
     }
 
+skip_copying:
     CHECK_EQ(0, mapper.unlock(buf->handle));
 
     if ((err = mNativeWindow->queueBuffer(mNativeWindow.get(), buf,