commit e8161a150e037c4b4c4d228134e908efe16a49de
author S Vasudev Prasad <vasudev.prasad@ittiam.com> Wed Jan 27 17:06:55 2021 +0530
committer S Vasudev Prasad <vasudev.prasad@ittiam.com> Fri Jan 29 06:01:17 2021 +0530
tree 5e711d1968fb2c5ec6f205b33be4d890f5cb9e04
parent c1bdb2ccd847fdbc3526abeef135c2e0936db79c

Codec2Fuzzer: Updated BufferSource parsing logic

Test: mmm frameworks/av/media/codec2/fuzzer
Bug: 178467473

Change-Id: I73a90ba7a733a3b87e730ac3df4e571a1a7f3eca

media/codec2/fuzzer/C2Fuzzer.h

diff --git a/media/codec2/fuzzer/C2Fuzzer.h b/media/codec2/fuzzer/C2Fuzzer.h
index 2efad50..d5ac81a 100644
--- a/media/codec2/fuzzer/C2Fuzzer.h
+++ b/media/codec2/fuzzer/C2Fuzzer.h
@@ -59,8 +59,9 @@
  private:
   class BufferSource {
    public:
-    BufferSource(const uint8_t* data, size_t size)
-        : mData(data), mSize(size), mReadIndex(size - kMarkerSize) {}
+    BufferSource(const uint8_t* data, size_t size) : mData(data), mSize(size) {
+      mReadIndex = (size <= kMarkerSize) ? 0 : (size - kMarkerSize);
+    }
     ~BufferSource() {
       mData = nullptr;
       mSize = 0;
@@ -72,10 +73,20 @@
     FrameData getFrame();
 
    private:
-    bool isMarker() { return (memcmp(&mData[mReadIndex], kMarker, kMarkerSize) == 0); }
+    bool isMarker() {
+      if ((kMarkerSize < mSize) && (mReadIndex < mSize - kMarkerSize)) {
+        return (memcmp(&mData[mReadIndex], kMarker, kMarkerSize) == 0);
+      } else {
+        return false;
+      }
+    }
 
     bool isCSDMarker(size_t position) {
-      return (memcmp(&mData[position], kCsdMarkerSuffix, kMarkerSuffixSize) == 0);
+      if ((kMarkerSuffixSize < mSize) && (position < mSize - kMarkerSuffixSize)) {
+        return (memcmp(&mData[position], kCsdMarkerSuffix, kMarkerSuffixSize) == 0);
+      } else {
+        return false;
+      }
     }
 
     bool searchForMarker();