Merge "libstagefright: fix possible overflow in amrwbenc." into mnc-dev
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index 38ba844..a90d958 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -327,7 +327,7 @@
size_t oldSize = mSize;
size_t offset = 0;
- while (offset + 10 <= mSize) {
+ while (mSize >= 10 && offset <= mSize - 10) {
if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
break;
}
@@ -339,7 +339,7 @@
return false;
}
- if (offset + dataSize + 10 > mSize) {
+ if (dataSize > mSize - 10 - offset) {
return false;
}
@@ -349,6 +349,9 @@
if (flags & 1) {
// Strip data length indicator
+ if (mSize < 14 || mSize - 14 < offset) {
+ return false;
+ }
memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
mSize -= 4;
dataSize -= 4;
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index 3afbd89..0a4440f 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -370,7 +370,7 @@
// Get max jpeg size (area-wise).
Size maxJpegResolution = getMaxJpegResolution();
if (maxJpegResolution.width == 0) {
- ALOGE("%s: Camera %d: Can't find find valid available jpeg sizes in static metadata!",
+ ALOGE("%s: Camera %d: Can't find valid available jpeg sizes in static metadata!",
__FUNCTION__, mId);
return BAD_VALUE;
}
@@ -397,6 +397,21 @@
return jpegBufferSize;
}
+ssize_t Camera3Device::getPointCloudBufferSize() const {
+ const int FLOATS_PER_POINT=4;
+ camera_metadata_ro_entry maxPointCount = mDeviceInfo.find(ANDROID_DEPTH_MAX_DEPTH_SAMPLES);
+ if (maxPointCount.count == 0) {
+ ALOGE("%s: Camera %d: Can't find maximum depth point cloud size in static metadata!",
+ __FUNCTION__, mId);
+ return BAD_VALUE;
+ }
+ ssize_t maxBytesForPointCloud = sizeof(android_depth_points) +
+ maxPointCount.data.i32[0] * sizeof(float) * FLOATS_PER_POINT;
+ return maxBytesForPointCloud;
+}
+
+
+
status_t Camera3Device::dump(int fd, const Vector<String16> &args) {
ATRACE_CALL();
(void)args;
@@ -865,14 +880,22 @@
sp<Camera3OutputStream> newStream;
if (format == HAL_PIXEL_FORMAT_BLOB) {
- ssize_t jpegBufferSize = getJpegBufferSize(width, height);
- if (jpegBufferSize <= 0) {
- SET_ERR_L("Invalid jpeg buffer size %zd", jpegBufferSize);
- return BAD_VALUE;
+ ssize_t blobBufferSize;
+ if (dataSpace != HAL_DATASPACE_DEPTH) {
+ blobBufferSize = getJpegBufferSize(width, height);
+ if (blobBufferSize <= 0) {
+ SET_ERR_L("Invalid jpeg buffer size %zd", blobBufferSize);
+ return BAD_VALUE;
+ }
+ } else {
+ blobBufferSize = getPointCloudBufferSize();
+ if (blobBufferSize <= 0) {
+ SET_ERR_L("Invalid point cloud buffer size %zd", blobBufferSize);
+ return BAD_VALUE;
+ }
}
-
newStream = new Camera3OutputStream(mNextStreamId, consumer,
- width, height, jpegBufferSize, format, dataSpace, rotation);
+ width, height, blobBufferSize, format, dataSpace, rotation);
} else {
newStream = new Camera3OutputStream(mNextStreamId, consumer,
width, height, format, dataSpace, rotation);
@@ -2067,8 +2090,12 @@
// Sanity check - if we have too many in-flight frames, something has
// likely gone wrong
- if (mInFlightMap.size() > kInFlightWarnLimit) {
+ if (!mIsConstrainedHighSpeedConfiguration && mInFlightMap.size() > kInFlightWarnLimit) {
CLOGE("In-flight list too large: %zu", mInFlightMap.size());
+ } else if (mIsConstrainedHighSpeedConfiguration && mInFlightMap.size() >
+ kInFlightWarnLimitHighSpeed) {
+ CLOGE("In-flight list too large for high speed configuration: %zu",
+ mInFlightMap.size());
}
}
diff --git a/services/camera/libcameraservice/device3/Camera3Device.h b/services/camera/libcameraservice/device3/Camera3Device.h
index 140da98..8bd0f8e 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.h
+++ b/services/camera/libcameraservice/device3/Camera3Device.h
@@ -146,6 +146,7 @@
virtual uint32_t getDeviceVersion();
virtual ssize_t getJpegBufferSize(uint32_t width, uint32_t height) const;
+ ssize_t getPointCloudBufferSize() const;
// Methods called by subclasses
void notifyStatus(bool idle); // updates from StatusTracker
@@ -153,9 +154,11 @@
private:
static const size_t kDumpLockAttempts = 10;
static const size_t kDumpSleepDuration = 100000; // 0.10 sec
- static const size_t kInFlightWarnLimit = 20;
static const nsecs_t kShutdownTimeout = 5000000000; // 5 sec
static const nsecs_t kActiveTimeout = 500000000; // 500 ms
+ static const size_t kInFlightWarnLimit = 20;
+ static const size_t kInFlightWarnLimitHighSpeed = 256; // batch size 32 * pipe depth 8
+
struct RequestTrigger;
// minimal jpeg buffer size: 256KB + blob header
static const ssize_t kMinJpegBufferSize = 256 * 1024 + sizeof(camera3_jpeg_blob);