video/common: resolved prevent defects
authorTaehwan Kim <t_h.kim@samsung.com>
Wed, 13 Feb 2013 08:05:23 +0000 (08:05 +0000)
committerTaehwan Kim <t_h.kim@samsung.com>
Wed, 20 Feb 2013 01:18:15 +0000 (01:18 +0000)
- 15864 : Null pointer dereferences

- 16787, 16788, 16790, 16791, 16793, 16794, 16795
: Memory-illegal access

Change-Id: I7d7f0e50f374115c80b60db60d7a6c866e526fed
Signed-off-by: Taehwan Kim <t_h.kim@samsung.com>
13 files changed:
component/common/Exynos_OMX_Basecomponent.c
component/common/Exynos_OMX_Baseport.c
component/video/dec/Exynos_OMX_Vdec.c
component/video/dec/Exynos_OMX_VdecControl.c
component/video/dec/h264/Exynos_OMX_H264dec.c
component/video/dec/mpeg2/Exynos_OMX_Mpeg2dec.c
component/video/dec/mpeg4/Exynos_OMX_Mpeg4dec.c
component/video/dec/vc1/Exynos_OMX_Wmvdec.c
component/video/dec/vp8/Exynos_OMX_Vp8dec.c
component/video/enc/Exynos_OMX_Venc.c
component/video/enc/Exynos_OMX_VencControl.c
component/video/enc/h264/Exynos_OMX_H264enc.c
component/video/enc/mpeg4/Exynos_OMX_Mpeg4enc.c

index 8785a51c06e63df5ada5bdad2552948efc050d0c..4e91847ab7d238c6c576ce38c5b133478bb8c633 100644 (file)
@@ -335,10 +335,7 @@ OMX_ERRORTYPE Exynos_OMX_ComponentStateSet(OMX_COMPONENTTYPE *pOMXComponent, OMX
         case OMX_StateLoaded:
             for (i = 0; i < pExynosComponent->portParam.nPorts; i++) {
                 pExynosPort = (pExynosComponent->pExynosPort + i);
-                if (pExynosPort == NULL) {
-                    ret = OMX_ErrorBadParameter;
-                    goto EXIT;
-                }
+
                 if (CHECK_PORT_TUNNELED(pExynosPort) && CHECK_PORT_BUFFER_SUPPLIER(pExynosPort)) {
                     if (CHECK_PORT_ENABLED(pExynosPort)) {
                         ret = pExynosComponent->exynos_AllocateTunnelBuffer(pExynosPort, i);
index 0650d709590d5222e207828724d1b5b7e192ed08..42b2d98fb654d1ae21133500dec6f334b2fd3804 100644 (file)
@@ -126,12 +126,16 @@ OMX_ERRORTYPE Exynos_OMX_BufferFlushProcess(OMX_COMPONENTTYPE *pOMXComponent, OM
     }
 
 EXIT:
-    if ((ret != OMX_ErrorNone) && (pOMXComponent != NULL) && (pExynosComponent != NULL)) {
+    if (ret != OMX_ErrorNone) {
         Exynos_OSAL_Log(EXYNOS_LOG_ERROR,"%s : %d", __FUNCTION__, __LINE__);
-        pExynosComponent->pCallbacks->EventHandler(pOMXComponent,
-                        pExynosComponent->callbackData,
-                        OMX_EventError,
-                        ret, 0, NULL);
+
+        if ((pOMXComponent != NULL) &&
+            (pExynosComponent != NULL)) {
+            pExynosComponent->pCallbacks->EventHandler(pOMXComponent,
+                            pExynosComponent->callbackData,
+                            OMX_EventError,
+                            ret, 0, NULL);
+        }
     }
 
     FunctionOut();
index 5e58096e7addad1ae937d4db78ee45f1101f295b..fefdd0ae8522116a254af7ab6b39fa6d894dbda2 100644 (file)
@@ -100,20 +100,22 @@ void Exynos_Free_CodecBuffers(
     EXYNOS_OMX_VIDEODEC_COMPONENT   *pVideoDec          = (EXYNOS_OMX_VIDEODEC_COMPONENT *)pExynosComponent->hComponentHandle;
     CODEC_DEC_BUFFER               **ppCodecBuffer      = NULL;
 
-    OMX_U32 nPlaneCnt = 0;
+    OMX_U32 nBufferCnt = 0, nPlaneCnt = 0;
     int i, j;
 
     FunctionIn();
 
     if (nPortIndex == INPUT_PORT_INDEX) {
         ppCodecBuffer = &(pVideoDec->pMFCDecInputBuffer[0]);
+        nBufferCnt = MFC_INPUT_BUFFER_NUM_MAX;
         nPlaneCnt = MFC_INPUT_BUFFER_PLANE;
     } else {
         ppCodecBuffer = &(pVideoDec->pMFCDecOutputBuffer[0]);
+        nBufferCnt = MFC_OUTPUT_BUFFER_NUM_MAX;
         nPlaneCnt = MFC_OUTPUT_BUFFER_PLANE;
     }
 
-    for (i = 0; i < MFC_OUTPUT_BUFFER_NUM_MAX; i++) {
+    for (i = 0; i < nBufferCnt; i++) {
         if (ppCodecBuffer[i] != NULL) {
             for (j = 0; j < nPlaneCnt; j++) {
                 if (ppCodecBuffer[i]->pVirAddr[j] != NULL)
index e99134f119a9feee755d240ae9883977543c9fe1..252b29ee5294249c7d58016d2997f6f119d98ff4 100644 (file)
@@ -761,6 +761,9 @@ OMX_ERRORTYPE Exynos_OutputBufferGetQueue(EXYNOS_OMX_BASECOMPONENT *pExynosCompo
         outputUseBuffer = &(pExynosPort->way.port2WayDataBuffer.outputDataBuffer);
     } else if (pExynosPort->bufferProcessType & BUFFER_SHARE) {
         outputUseBuffer = &(pExynosPort->way.port2WayDataBuffer.inputDataBuffer);
+    } else {
+        ret = OMX_ErrorUndefined;
+        goto EXIT;
     }
 
     if (pExynosComponent->currentState != OMX_StateExecuting) {
index f2c5af05b497f7830dbd09ebcb6b1ce9b928db39..5269d4cf1601170c4be9ca3631479276d713bcae 100644 (file)
@@ -1891,17 +1891,21 @@ OMX_ERRORTYPE Exynos_H264Dec_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OMX
         pSrcOutputData->allocSize  = pVideoBuffer->planes[0].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer != pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer ==
+                        pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
+                    pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */
index 947c684f5083652ed79aa009f3ff8cd9e94d08f8..3bd76e97ed552546b9f6e553a6951a1a648fb74d 100644 (file)
@@ -1513,17 +1513,21 @@ OMX_ERRORTYPE Exynos_Mpeg2Dec_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OM
         pSrcOutputData->allocSize  = pVideoBuffer->planes[0].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer != pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer ==
+                        pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
+                    pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */
index 400f307293d6eef87ffb1cfcc364ebd124d14077..680d49f8d84adc6a3eaad13ce341a1e6aa5cc5b7 100644 (file)
@@ -1866,17 +1866,21 @@ OMX_ERRORTYPE Exynos_Mpeg4Dec_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OM
         pSrcOutputData->allocSize  = pVideoBuffer->planes[0].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer != pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer ==
+                        pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
+                    pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */
index b588ffa57351702c4db9518fc8184a0dc4101ae5..a0b31d9994508e9117cc3e18906fe74136e55de3 100644 (file)
@@ -1152,6 +1152,7 @@ OMX_ERRORTYPE Exynos_WmvDec_GetParameter(
 
         if (pDstWmvParam->nPortIndex > OUTPUT_PORT_INDEX) {
             ret = OMX_ErrorBadPortIndex;
+            goto EXIT;
         }
 
         pWmvDec = (EXYNOS_WMVDEC_HANDLE *)((EXYNOS_OMX_VIDEODEC_COMPONENT *)pExynosComponent->hComponentHandle)->hCodecHandle;
@@ -1746,17 +1747,21 @@ OMX_ERRORTYPE Exynos_WmvDec_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OMX_
         pSrcOutputData->allocSize  = pVideoBuffer->planes[0].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer != pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer ==
+                        pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
+                    pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */
index e1c9b6fbedd1ed7dccd65510264ccbfae0d7facd..c1af2c749377e4cd521b900e7539f386764a9e18 100644 (file)
@@ -1457,17 +1457,21 @@ OMX_ERRORTYPE Exynos_VP8Dec_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OMX_
         pSrcOutputData->allocSize  = pVideoBuffer->planes[0].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer != pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.singlePlaneBuffer.dataBuffer ==
+                        pVideoDec->pMFCDecInputBuffer[i]->pVirAddr[0]) {
+                    pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoDec->pMFCDecInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoDec->pMFCDecInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "Can not find buffer");
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecDecode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */
index 8dc61586f28c469572b62d57568d93be71645625..d3c1d609554bc23c83066a273d0637142f5a0d51 100644 (file)
@@ -89,20 +89,22 @@ void Exynos_Free_CodecBuffers(
     EXYNOS_OMX_VIDEOENC_COMPONENT   *pVideoEnc          = (EXYNOS_OMX_VIDEOENC_COMPONENT *)pExynosComponent->hComponentHandle;
     CODEC_ENC_BUFFER               **ppCodecBuffer      = NULL;
 
-    OMX_U32 nPlaneCnt = 0;
+    OMX_U32 nBufferCnt = 0, nPlaneCnt = 0;
     int i, j;
 
     FunctionIn();
 
     if (nPortIndex == INPUT_PORT_INDEX) {
         ppCodecBuffer = &(pVideoEnc->pMFCEncInputBuffer[0]);
+        nBufferCnt = MFC_INPUT_BUFFER_NUM_MAX;
         nPlaneCnt = MFC_INPUT_BUFFER_PLANE;
     } else {
         ppCodecBuffer = &(pVideoEnc->pMFCEncOutputBuffer[0]);
+        nBufferCnt = MFC_OUTPUT_BUFFER_NUM_MAX;
         nPlaneCnt = MFC_OUTPUT_BUFFER_PLANE;
     }
 
-    for (i = 0; i < MFC_OUTPUT_BUFFER_NUM_MAX; i++) {
+    for (i = 0; i < nBufferCnt; i++) {
         if (ppCodecBuffer[i] != NULL) {
             for (j = 0; j < nPlaneCnt; j++) {
                 if (ppCodecBuffer[i]->pVirAddr[j] != NULL)
index 6d7bdb5b89e5048df6ab36650b34ae04aba269b1..fbd3b6d2a38fc3760cfb44a6cb56414f50b478a5 100644 (file)
@@ -1006,6 +1006,9 @@ OMX_ERRORTYPE Exynos_OutputBufferGetQueue(
         pDataBuffer = &(pExynosPort->way.port2WayDataBuffer.outputDataBuffer);
     } else if (pExynosPort->bufferProcessType & BUFFER_SHARE) {
         pDataBuffer = &(pExynosPort->way.port2WayDataBuffer.inputDataBuffer);
+    } else {
+        ret = OMX_ErrorUndefined;
+        goto EXIT;
     }
 
     if (pExynosComponent->currentState != OMX_StateExecuting) {
@@ -1014,8 +1017,7 @@ OMX_ERRORTYPE Exynos_OutputBufferGetQueue(
     } else if ((pExynosComponent->transientState != EXYNOS_OMX_TransStateExecutingToIdle) &&
                (!CHECK_PORT_BEING_FLUSHED(pExynosPort))) {
         Exynos_OSAL_SemaphoreWait(pExynosPort->bufferSemID);
-        if ((pDataBuffer != NULL) &&
-            (pDataBuffer->dataValid != OMX_TRUE)) {
+        if (pDataBuffer->dataValid != OMX_TRUE) {
             pMessage = (EXYNOS_OMX_MESSAGE *)Exynos_OSAL_Dequeue(&pExynosPort->bufferQ);
             if (pMessage == NULL) {
                 ret = OMX_ErrorUndefined;
index 32b06b68bd594f03bffeeaf977c76bdc10bb0967..856d2894311c2a6cab70c07b6ea0df247997cabe 100644 (file)
@@ -1860,17 +1860,21 @@ OMX_ERRORTYPE Exynos_H264Enc_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OMX
                                         pVideoBuffer->planes[2].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.multiPlaneBuffer.dataBuffer[0] != pVideoEnc->pMFCEncInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "%s: %d: Failed - Lost buffer", __FUNCTION__, __LINE__);
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecEncode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.multiPlaneBuffer.dataBuffer[0] ==
+                        pVideoEnc->pMFCEncInputBuffer[i]->pVirAddr[0]) {
+                    pVideoEnc->pMFCEncInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoEnc->pMFCEncInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoEnc->pMFCEncInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoEnc->pMFCEncInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "%s: %d: Failed - Lost buffer", __FUNCTION__, __LINE__);
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecEncode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */
index ccbb485f177f6ef6f3547a61c5de5737d27f3805..cf0e10a471fb8e0a9970e98c9e7aa2b3864f89d3 100644 (file)
@@ -2049,17 +2049,21 @@ OMX_ERRORTYPE Exynos_Mpeg4Enc_SrcOut(OMX_COMPONENTTYPE *pOMXComponent, EXYNOS_OM
                                         pVideoBuffer->planes[2].allocSize;
 
         if (pExynosInputPort->bufferProcessType & BUFFER_COPY) {
-            int i = 0;
-            while (pSrcOutputData->buffer.multiPlaneBuffer.dataBuffer[0] != pVideoEnc->pMFCEncInputBuffer[i]->pVirAddr[0]) {
-                if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
-                    Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "%s: %d: Failed - Lost buffer", __FUNCTION__, __LINE__);
-                    ret = (OMX_ERRORTYPE)OMX_ErrorCodecEncode;
-                    goto EXIT;
+            int i;
+            for (i = 0; i < MFC_INPUT_BUFFER_NUM_MAX; i++) {
+                if (pSrcOutputData->buffer.multiPlaneBuffer.dataBuffer[0] ==
+                        pVideoEnc->pMFCEncInputBuffer[i]->pVirAddr[0]) {
+                    pVideoEnc->pMFCEncInputBuffer[i]->dataSize = 0;
+                    pSrcOutputData->pPrivate = pVideoEnc->pMFCEncInputBuffer[i];
+                    break;
                 }
-                i++;
             }
-            pVideoEnc->pMFCEncInputBuffer[i]->dataSize = 0;
-            pSrcOutputData->pPrivate = pVideoEnc->pMFCEncInputBuffer[i];
+
+            if (i >= MFC_INPUT_BUFFER_NUM_MAX) {
+                Exynos_OSAL_Log(EXYNOS_LOG_ERROR, "%s: %d: Failed - Lost buffer", __FUNCTION__, __LINE__);
+                ret = (OMX_ERRORTYPE)OMX_ErrorCodecEncode;
+                goto EXIT;
+            }
         }
 
         /* For Share Buffer */