Commit 1b6cc5af authored by John Lin's avatar John Lin Committed by Pier Angelo Vendrame
Browse files

Bug 2047802 - validate SampleBuffer I/O bounds. a=pascalc 

Original Revision: https://phabricator.services.mozilla.com/D307893

Differential Revision: https://phabricator.services.mozilla.com/D310670
parent ea46058a

dom/media/platforms/android/AndroidDataEncoder.cpp

+4 −4
Original line number Diff line number Diff line
@@ -254,8 +254,8 @@ static RefPtr<MediaByteBuffer> ExtractCodecConfig( 
  auto config = MakeRefPtr<MediaByteBuffer>(aSize);

  config->SetLength(aSize);

  NS_ENSURE_SUCCESS(

      aBuffer->NativeCopy(reinterpret_cast<jlong>(config->Elements()), aOffset,

                          aSize),

      aBuffer->NativeCopy(reinterpret_cast<jlong>(config->Elements()),

                          config->Length(), aOffset, aSize),

      nullptr);

  if (!aAsAVCC) {

    return config;
@@ -369,7 +369,7 @@ RefPtr<MediaRawData> AndroidDataEncoder::GetOutputData( 
  }



  NS_ENSURE_SUCCESS(aBuffer->NativeCopy(reinterpret_cast<jlong>(writer->Data()),

                                        aOffset, aSize),

                                        writer->Size(), aOffset, aSize),

                    nullptr);

  output->mKeyframe = aIsKeyFrame;
@@ -405,7 +405,7 @@ RefPtr<MediaRawData> AndroidDataEncoder::GetOutputDataH264( 


  NS_ENSURE_SUCCESS(

      aBuffer->NativeCopy(reinterpret_cast<jlong>(writer->Data() + prependSize),

                          aOffset, aSize),

                          writer->Size() - prependSize, aOffset, aSize),

      nullptr);



  if (asAVCC && !AnnexB::ConvertSampleToAVCC(output, avccHeader)) {

dom/media/platforms/android/RemoteDataDecoder.cpp

+3 −2
Original line number Diff line number Diff line
@@ -812,8 +812,9 @@ class RemoteAudioDecoder final : public RemoteDataDecoder { 
        LOG("OOM while allocating temporary output buffer");

        return;

      }

      nsresult rv = aBuffer->NativeCopy(reinterpret_cast<jlong>(audio.get()),

                                        offset, size);

      nsresult rv =

          aBuffer->NativeCopy(reinterpret_cast<jlong>(audio.get()),

                              audio.Length() * sampleSize, offset, size);

      if (NS_FAILED(rv)) {

        LOG("Fail to copy audio buffer");

        Error(MediaResult(rv, __func__));

mobile/android/geckoview/src/main/java/org/mozilla/gecko/media/SampleBuffer.java

+27 −8
Original line number Diff line number Diff line
@@ -50,11 +50,27 @@ public final class SampleBuffer implements Parcelable { 
    return mSharedMem != null ? mSharedMem.getSize() : 0;

  }



  private void checkBounds(

      final int offset, final int size, final int inCapacity, final int outCapacity)

      throws IOException {

    if (mSharedMem == null || !mSharedMem.isValid()) {

      throw new IOException("Invalid state.");

    }

    if (offset < 0 || size < 0) {

      throw new IOException("Illegal source offset/size");

    }

    final long inEnd = (long) offset + size;

    if (inEnd > inCapacity || size > outCapacity) {

      throw new IOException("Out-of-bound: buffer too small.");

    }

  }



  public void readFromByteBuffer(final ByteBuffer src, final int offset, final int size)

      throws IOException {

    if (!src.isDirect()) {

      throw new IOException("SharedMemBuffer only support reading from direct byte buffer.");

    }

    checkBounds(offset, size, src.capacity(), capacity());

    try {

      nativeReadFromDirectBuffer(src, mSharedMem.getPointer(), offset, size);

      mSharedMem.flush();
@@ -72,6 +88,7 @@ public final class SampleBuffer implements Parcelable { 
    if (!dest.isDirect()) {

      throw new IOException("SharedMemBuffer only support writing to direct byte buffer.");

    }

    checkBounds(offset, size, capacity(), dest.capacity());

    try {

      nativeWriteToDirectBuffer(mSharedMem.getPointer(), dest, offset, size);

    } catch (final NullPointerException e) {
@@ -83,16 +100,18 @@ public final class SampleBuffer implements Parcelable { 
      long src, ByteBuffer dest, int offset, int size);



  @WrapForJNI(exceptionMode = "nsresult")

  public void nativeCopy(final long dest, final int offset, final int size) throws IOException {

    if (mSharedMem == null || !mSharedMem.isValid()) {

      throw new IOException("Invalid state.");

    }

    if (offset + size > mSharedMem.getSize()) {

      throw new IOException("Out-of-bound: buffer too small.");

  public void nativeCopy(final long dest, final int destCapacity, final int offset, final int size)

      throws IOException {

    if (dest == 0) {

      throw new IOException("Null destination pointer.");

    }

    checkBounds(offset, size, capacity(), destCapacity);

    try {

      final long src = mSharedMem.getPointer() + offset;

      nativeMemcpy(dest, src, size);

      final long src = mSharedMem.getPointer();

      if (src == 0) {

        throw new IOException("Shared memory not mapped.");

      }

      nativeMemcpy(dest, src + offset, size);

    } catch (final NullPointerException e) {

      throw new IOException(e);

    }