projects
/
platform
/
core
/
multimedia
/
libmm-camcorder.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Fix coverity issue
[platform/core/multimedia/libmm-camcorder.git]
/
src
/
mm_camcorder_util.c
diff --git
a/src/mm_camcorder_util.c
b/src/mm_camcorder_util.c
index
0e6bc3f
..
55de4a2
100644
(file)
--- a/
src/mm_camcorder_util.c
+++ b/
src/mm_camcorder_util.c
@@
-46,6
+46,8
@@
-----------------------------------------------------------------------*/
#define TIME_STRING_MAX_LEN 64
#define __MMCAMCORDER_CAPTURE_WAIT_TIMEOUT 5
-----------------------------------------------------------------------*/
#define TIME_STRING_MAX_LEN 64
#define __MMCAMCORDER_CAPTURE_WAIT_TIMEOUT 5
+#define __MMCAMCORDER_MAX_WIDTH 8192
+#define __MMCAMCORDER_MAX_HEIGHT 8192
#define FPUTC_CHECK(x_char, x_file) \
{ \
#define FPUTC_CHECK(x_char, x_file) \
{ \
@@
-1216,6
+1218,7
@@
gboolean _mmcamcorder_msg_callback(void *data)
/* remove item from msg data */
if (hcamcorder->msg_data) {
/* remove item from msg data */
if (hcamcorder->msg_data) {
+ /*_mmcam_dbg_log("remove item %p", item);*/
hcamcorder->msg_data = g_list_remove(hcamcorder->msg_data, item);
} else {
_mmcam_dbg_warn("msg_data is NULL but item[%p] will be removed", item);
hcamcorder->msg_data = g_list_remove(hcamcorder->msg_data, item);
} else {
_mmcam_dbg_warn("msg_data is NULL but item[%p] will be removed", item);
@@
-1246,10
+1249,9
@@
MSG_CALLBACK_DONE:
} else if (item->id == MM_MESSAGE_CAMCORDER_VIDEO_CAPTURED || item->id == MM_MESSAGE_CAMCORDER_AUDIO_CAPTURED) {
MMCamRecordingReport *report = (MMCamRecordingReport *)item->param.data;
if (report) {
} else if (item->id == MM_MESSAGE_CAMCORDER_VIDEO_CAPTURED || item->id == MM_MESSAGE_CAMCORDER_AUDIO_CAPTURED) {
MMCamRecordingReport *report = (MMCamRecordingReport *)item->param.data;
if (report) {
- if (report->recording_filename)
- SAFE_G_FREE(report->recording_filename);
-
- SAFE_G_FREE(report);
+ SAFE_G_FREE(report->recording_filename);
+ g_free(report);
+ report = NULL;
item->param.data = NULL;
}
}
item->param.data = NULL;
}
}
@@
-1861,7
+1863,7
@@
gboolean _mmcamcorder_encode_jpeg(void *src_data, unsigned int src_width, unsign
return FALSE;
}
return FALSE;
}
- ret = mm_util_jpeg_encode_to_memory(result_data,
(int *)
result_length,
+ ret = mm_util_jpeg_encode_to_memory(result_data, result_length,
converted_src, src_width, src_height, jpeg_format, jpeg_quality);
if (converted_src && (converted_src != src_data)) {
converted_src, src_width, src_height, jpeg_format, jpeg_quality);
if (converted_src && (converted_src != src_data)) {
@@
-2240,6
+2242,12
@@
static gboolean _mmcamcorder_convert_NV12_to_I420(unsigned char *src, guint widt
return FALSE;
}
return FALSE;
}
+ /* buffer overflow prevention check */
+ if (width > __MMCAMCORDER_MAX_WIDTH || height > __MMCAMCORDER_MAX_HEIGHT) {
+ _mmcam_dbg_err("too large size %d x %d", width, height);
+ return FALSE;
+ }
+
dst_size = (width * height * 3) >> 1;
_mmcam_dbg_log("NV12 -> I420 : %dx%d, dst size %d", width, height, dst_size);
dst_size = (width * height * 3) >> 1;
_mmcam_dbg_log("NV12 -> I420 : %dx%d, dst size %d", width, height, dst_size);