commit c1c50e7b47784c5e6978eda67db68ef4951144c6
author Marco Nelissen <marcone@google.com> Thu Mar 10 15:02:13 2016 -0800
committer Marco Nelissen <marcone@google.com> Fri Mar 11 14:47:45 2016 -0800
tree f53286f0d92416525fee698ce7983f609759da19
parent f1a2668f4f09e38722424a6a74f0ea26f49e4110

Fix size check for OMX_IndexParamConsumerUsageBits

since it doesn't follow the OMX convention. And remove support
for the kClientNeedsFrameBuffer flag.

Bug: 27207275
Change-Id: Ia2c119e2456ebf9e2f4e1de5104ef9032a212255

media/libmedia/IOMX.cpp

diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index 84925f1..9be9b41 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -24,6 +24,7 @@
 #include <binder/Parcel.h>
 #include <media/IOMX.h>
 #include <media/stagefright/foundation/ADebug.h>
+#include <media/openmax/OMX_IndexExt.h>
 
 namespace android {
 
@@ -698,7 +699,8 @@
             void *params = NULL;
             size_t pageSize = 0;
             size_t allocSize = 0;
-            if (code != SET_INTERNAL_OPTION && size < 8) {
+            if ((index == (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits && size < 4) ||
+                    (code != SET_INTERNAL_OPTION && size < 8)) {
                 // we expect the structure to contain at least the size and
                 // version, 8 bytes total
                 ALOGE("b/27207275 (%zu)", size);
@@ -720,7 +722,9 @@
                     } else {
                         err = NOT_ENOUGH_DATA;
                         OMX_U32 declaredSize = *(OMX_U32*)params;
-                        if (code != SET_INTERNAL_OPTION && declaredSize > size) {
+                        if (code != SET_INTERNAL_OPTION &&
+                                index != (OMX_INDEXTYPE) OMX_IndexParamConsumerUsageBits &&
+                                declaredSize > size) {
                             // the buffer says it's bigger than it actually is
                             ALOGE("b/27207275 (%u/%zu)", declaredSize, size);
                             android_errorWriteLog(0x534e4554, "27207275");