[prev in list] [next in list] [prev in thread] [next in thread] 

List:       helix-datatype-cvs
Subject:    [Datatype-cvs] omx/video/decoder COmxVideoDec.cpp, 1.1.2.19,
From:       xzhao () helixcommunity ! org
Date:       2010-09-27 2:34:56
Message-ID: 201009270234.o8R2Yncw030311 () mailer ! progressive-comp ! com
[Download RAW message or body]

Update of /cvsroot/datatype/omx/video/decoder
In directory cvs01.internal.helixcommunity.org:/tmp/cvs-serv10708

Modified Files:
      Tag: hxclient_3_1_0_atlas
	COmxVideoDec.cpp 
Log Message:
> Bug Number: 11341
> 
> Bug URL:  https://bugs.helixcommunity.org/show_bug.cgi?id=11341
> 
> Synopsis: MediaServer will crash when playing an specified MKV video
> 
> Overview: For some buggy stream, the NAL size is wrong, which is even bigger than \
> the input packet size(HXCODEC_DATA.dataLength). And because OMX wrapper's some \
> variables are defined as unsigned int, which may roll over under this case, then \
> memory pointers will be set as some invalid value, so system crashes. Fix is to \
> return HXR_FAIL under this error case as attached. 
> Files Added:
> NA
> 
> Files Modified:
> COmxVideoDec.cpp


Index: COmxVideoDec.cpp
===================================================================
RCS file: /cvsroot/datatype/omx/video/decoder/COmxVideoDec.cpp,v
retrieving revision 1.1.2.19
retrieving revision 1.1.2.20
diff -u -d -r1.1.2.19 -r1.1.2.20
--- COmxVideoDec.cpp	15 Jul 2010 01:35:11 -0000	1.1.2.19
+++ COmxVideoDec.cpp	27 Sep 2010 02:34:53 -0000	1.1.2.20
@@ -419,7 +419,15 @@
         {
                 if(m_bHasAVCC)
                 {
+                    if (size <= m_ulNALUSizeField)
+                    {
+                        return HXR_FAIL;
+                    }
                     unsigned int nNalSize = GetNALSize(pBuff, m_ulNALUSizeField);
+                    if (nNalSize > size - m_ulNALUSizeField)
+                    {
+                        return HXR_FAIL;
+                    }
                     pBuff += m_ulNALUSizeField;
                     size -= m_ulNALUSizeField;
                     used = m_ulNALUSizeField;


_______________________________________________
Datatype-cvs mailing list
Datatype-cvs@helixcommunity.org
http://lists.helixcommunity.org/mailman/listinfo/datatype-cvs


[prev in list] [next in list] [prev in thread] [next in thread]