diff options
| author | Steve Pfetsch <spfetsch@google.com> | 2016-04-05 00:13:47 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2016-04-05 00:13:47 +0000 |
| commit | af0b35a2e7f4d246242c0f35fcde04858dd6670d (patch) | |
| tree | 0187ef8aa9c7f0d64e754a3933ae3771ccce61ff /msm8974 | |
| parent | 16ee85d1d456a4b694fd32baa5f52341e638b5d8 (diff) | |
| parent | 00c00c349f132b5bba20e26ed54d01e9be9f87e4 (diff) | |
| download | media-af0b35a2e7f4d246242c0f35fcde04858dd6670d.tar.gz | |
Merge "mm-video-v4l2: vdec: Add range check before native_buffer usage" into nyc-dev
Diffstat (limited to 'msm8974')
| -rw-r--r-- | msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp | 31 |
1 files changed, 25 insertions, 6 deletions
diff --git a/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp index ed64403..6b53aa3 100644 --- a/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp +++ b/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp @@ -6469,9 +6469,20 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer(OMX_IN OMX_HANDLETYPE hComp, return OMX_ErrorBadParameter; } - //Store private handle from GraphicBuffer - native_buffer[nPortIndex].privatehandle = handle; - native_buffer[nPortIndex].nativehandle = handle; + //Fill outputbuffer with buffer details, this will be sent to f/w during VIDIOC_QBUF + nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr()); + if (nPortIndex < drv_ctx.op_buf.actualcount && + nPortIndex < MAX_NUM_INPUT_OUTPUT_BUFFERS) { + drv_ctx.ptr_outputbuffer[nPortIndex].pmem_fd = handle->fd; + drv_ctx.ptr_outputbuffer[nPortIndex].bufferaddr = (OMX_U8*) buffer; + + //Store private handle from GraphicBuffer + native_buffer[nPortIndex].privatehandle = handle; + native_buffer[nPortIndex].nativehandle = handle; + } else { + DEBUG_PRINT_ERROR("[FTB]Invalid native_buffer index: %d", nPortIndex); + return OMX_ErrorBadParameter; + } //buffer->nAllocLen will be sizeof(struct VideoDecoderOutputMetaData). Overwrite //this with a more sane size so that we don't compensate in rest of code @@ -7388,8 +7399,14 @@ OMX_ERRORTYPE omx_vdec::fill_buffer_done(OMX_HANDLETYPE hComp, } //Clear graphic buffer handles in dynamic mode - native_buffer[nPortIndex].privatehandle = NULL; - native_buffer[nPortIndex].nativehandle = NULL; + if (nPortIndex < drv_ctx.op_buf.actualcount && + nPortIndex < MAX_NUM_INPUT_OUTPUT_BUFFERS) { + native_buffer[nPortIndex].privatehandle = NULL; + native_buffer[nPortIndex].nativehandle = NULL; + } else { + DEBUG_PRINT_ERROR("[FBD]Invalid native_buffer index: %d", nPortIndex); + return OMX_ErrorBadParameter; + } } m_cb.FillBufferDone (hComp,m_app_data,il_buffer); } else { @@ -7408,7 +7425,9 @@ OMX_ERRORTYPE omx_vdec::fill_buffer_done(OMX_HANDLETYPE hComp, private_handle_t *private_handle = NULL; dim.sliceWidth = framesize.nWidth; dim.sliceHeight = framesize.nHeight; - if (native_buffer[buf_index].privatehandle) + if (buf_index < drv_ctx.op_buf.actualcount && + buf_index < MAX_NUM_INPUT_OUTPUT_BUFFERS && + native_buffer[buf_index].privatehandle) private_handle = native_buffer[buf_index].privatehandle; if (private_handle) { DEBUG_PRINT_LOW("set metadata: update buf-geometry with stride %d slice %d", |