diff options
| author | Andreas Huber <andih@google.com> | 2009-12-04 08:45:01 -0800 |
|---|---|---|
| committer | Andreas Huber <andih@google.com> | 2009-12-04 08:47:33 -0800 |
| commit | a0a60cced1187d50d7b4cab4e0b87679ac2f4505 (patch) | |
| tree | d0c1fe292fbcc4ef71d0090785e1470f95c9461f /omx | |
| parent | 3000a016292019e74a9afbd65aa95c669c1c4b94 (diff) | |
| download | omap3-a0a60cced1187d50d7b4cab4e0b87679ac2f4505.tar.gz | |
A certain GetParameter call on both the AMR and WBAMR codecs attempted to illegally write to the parameter block.
Diffstat (limited to 'omx')
| -rw-r--r-- | omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c | 10 | ||||
| -rw-r--r-- | omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c | 10 |
2 files changed, 18 insertions, 2 deletions
diff --git a/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c b/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c index 0a9f78a..5760d95 100644 --- a/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c +++ b/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c @@ -1115,7 +1115,15 @@ static OMX_ERRORTYPE SetParameter (OMX_HANDLETYPE hComp, case OMX_IndexParamAudioAmr: OMX_PRDSP2(pComponentPrivate->dbg, "%d :: SetParameter OMX_IndexParamAudioAmr \n",__LINE__); - pCompAmrParam = (OMX_AUDIO_PARAM_AMRTYPE *)pCompParam; + + // Code below attempts to write to passed-in parameter block, + // which not only is illegal (it's supposed to be read-only), + // also in this particular case it seems to live in read-only + // memory or something. + OMX_AUDIO_PARAM_AMRTYPE copy; + memcpy(©, pCompParam, sizeof(copy)); + pCompAmrParam = © + if(pCompAmrParam->nPortIndex == 0) { /* 0 means Input port */ memcpy(((AMRENC_COMPONENT_PRIVATE*) pHandle->pComponentPrivate)->pcmParams, pCompAmrParam, sizeof(OMX_AUDIO_PARAM_AMRTYPE)); diff --git a/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c b/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c index 2cf04f7..17c298b 100644 --- a/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c +++ b/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c @@ -1072,7 +1072,15 @@ static OMX_ERRORTYPE SetParameter (OMX_HANDLETYPE hComp, case OMX_IndexParamAudioAmr: { OMX_PRDSP2(pComponentPrivate->dbg, "OMX_IndexParamAudioAmr"); - pCompAmrParam = (OMX_AUDIO_PARAM_AMRTYPE *)pCompParam; + + // Code below attempts to write to passed-in parameter block, + // which not only is illegal (it's supposed to be read-only), + // also in this particular case it seems to live in read-only + // memory or something. + OMX_AUDIO_PARAM_AMRTYPE copy; + memcpy(©, pCompParam, sizeof(copy)); + pCompAmrParam = © + if(pCompAmrParam->nPortIndex == 0) { /* 0 means Input port */ memcpy(((WBAMRENC_COMPONENT_PRIVATE*) pHandle->pComponentPrivate)->pcmParams, |