From a0a60cced1187d50d7b4cab4e0b87679ac2f4505 Mon Sep 17 00:00:00 2001 From: Andreas Huber Date: Fri, 4 Dec 2009 08:45:01 -0800 Subject: A certain GetParameter call on both the AMR and WBAMR codecs attempted to illegally write to the parameter block. --- omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c | 10 +++++++++- omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c | 10 +++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) (limited to 'omx') diff --git a/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c b/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c index 0a9f78a..5760d95 100644 --- a/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c +++ b/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c @@ -1115,7 +1115,15 @@ static OMX_ERRORTYPE SetParameter (OMX_HANDLETYPE hComp, case OMX_IndexParamAudioAmr: OMX_PRDSP2(pComponentPrivate->dbg, "%d :: SetParameter OMX_IndexParamAudioAmr \n",__LINE__); - pCompAmrParam = (OMX_AUDIO_PARAM_AMRTYPE *)pCompParam; + + // Code below attempts to write to passed-in parameter block, + // which not only is illegal (it's supposed to be read-only), + // also in this particular case it seems to live in read-only + // memory or something. + OMX_AUDIO_PARAM_AMRTYPE copy; + memcpy(©, pCompParam, sizeof(copy)); + pCompAmrParam = © + if(pCompAmrParam->nPortIndex == 0) { /* 0 means Input port */ memcpy(((AMRENC_COMPONENT_PRIVATE*) pHandle->pComponentPrivate)->pcmParams, pCompAmrParam, sizeof(OMX_AUDIO_PARAM_AMRTYPE)); diff --git a/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c b/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c index 2cf04f7..17c298b 100644 --- a/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c +++ b/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c @@ -1072,7 +1072,15 @@ static OMX_ERRORTYPE SetParameter (OMX_HANDLETYPE hComp, case OMX_IndexParamAudioAmr: { OMX_PRDSP2(pComponentPrivate->dbg, "OMX_IndexParamAudioAmr"); - pCompAmrParam = (OMX_AUDIO_PARAM_AMRTYPE *)pCompParam; + + // Code below attempts to write to passed-in parameter block, + // which not only is illegal (it's supposed to be read-only), + // also in this particular case it seems to live in read-only + // memory or something. + OMX_AUDIO_PARAM_AMRTYPE copy; + memcpy(©, pCompParam, sizeof(copy)); + pCompAmrParam = © + if(pCompAmrParam->nPortIndex == 0) { /* 0 means Input port */ memcpy(((WBAMRENC_COMPONENT_PRIVATE*) pHandle->pComponentPrivate)->pcmParams, -- cgit v1.2.3