Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-04 13:07:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1073350: Validate that returned decoded Shmems have enough data r=cpearce

Browse Source
This commit is contained in:
Randell Jesup 2014-10-01 22:13:18 -04:00
parent 7928574529
commit ae25cd3a81
3 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
content/media/gmp/GMPVideoDecoderParent.cpp
View File

@ -228,6 +228,10 @@ GMPVideoDecoderParent::RecvDecoded(const GMPVideoi420FrameData& aDecodedFrame)
return false;
}
if (!GMPVideoi420FrameImpl::CheckFrameData(aDecodedFrame)) {
LOG(PR_LOG_ERROR, ("%s: Decoded frame corrupt, ignoring", __FUNCTION__));
return false;
}
auto f = new GMPVideoi420FrameImpl(aDecodedFrame, &mVideoHost);
// Ignore any return code. It is OK for this to fail without killing the process.

25
content/media/gmp/GMPVideoi420FrameImpl.cpp
View File

@ -63,6 +63,31 @@ GMPVideoi420FrameImpl::Destroy()
delete this;
}
/* static */ bool
GMPVideoi420FrameImpl::CheckFrameData(const GMPVideoi420FrameData& aFrameData)
{
// We may be passed the "wrong" shmem (one smaller than the actual size).
// This implies a bug or serious error on the child size. Ignore this frame if so.
// Note: Size() greater than expected is also an error, but with no negative consequences
int32_t half_width = (aFrameData.mWidth() + 1) / 2;
if ((aFrameData.mYPlane().mStride() <= 0) || (aFrameData.mYPlane().mSize() <= 0) ||
(aFrameData.mUPlane().mStride() <= 0) || (aFrameData.mUPlane().mSize() <= 0) ||
(aFrameData.mVPlane().mStride() <= 0) || (aFrameData.mVPlane().mSize() <= 0) ||
(aFrameData.mYPlane().mSize() > (int32_t) aFrameData.mYPlane().mBuffer().Size<uint8_t>()) ||
(aFrameData.mUPlane().mSize() > (int32_t) aFrameData.mUPlane().mBuffer().Size<uint8_t>()) ||
(aFrameData.mVPlane().mSize() > (int32_t) aFrameData.mVPlane().mBuffer().Size<uint8_t>()) ||
(aFrameData.mYPlane().mStride() < aFrameData.mWidth()) ||
(aFrameData.mUPlane().mStride() < half_width) ||
(aFrameData.mVPlane().mStride() < half_width) ||
(aFrameData.mYPlane().mSize() < aFrameData.mYPlane().mStride() * aFrameData.mHeight()) ||
(aFrameData.mUPlane().mSize() < aFrameData.mUPlane().mStride() * ((aFrameData.mHeight()+1)/2)) ||
(aFrameData.mVPlane().mSize() < aFrameData.mVPlane().mStride() * ((aFrameData.mHeight()+1)/2)))
{
return false;
}
return true;
}
bool
GMPVideoi420FrameImpl::CheckDimensions(int32_t aWidth, int32_t aHeight,
int32_t aStride_y, int32_t aStride_u, int32_t aStride_v)

2
content/media/gmp/GMPVideoi420FrameImpl.h
View File

@ -24,6 +24,8 @@ public:
GMPVideoi420FrameImpl(const GMPVideoi420FrameData& aFrameData, GMPVideoHostImpl* aHost);
virtual ~GMPVideoi420FrameImpl();
static bool CheckFrameData(const GMPVideoi420FrameData& aFrameData);
bool InitFrameData(GMPVideoi420FrameData& aFrameData);
const GMPPlaneImpl* GetPlane(GMPPlaneType aType) const;
GMPPlaneImpl* GetPlane(GMPPlaneType aType);