Fix coverity issue

[platform/core/multimedia/libmm-camcorder.git] / src / mm_camcorder_util.c

diff --git a/src/mm_camcorder_util.c b/src/mm_camcorder_util.c
index 0e6bc3f..55de4a2 100644 (file)
--- a/src/mm_camcorder_util.c
+++ b/src/mm_camcorder_util.c
@@ -46,6 +46,8 @@
 -----------------------------------------------------------------------*/
 #define TIME_STRING_MAX_LEN                     64
 #define __MMCAMCORDER_CAPTURE_WAIT_TIMEOUT      5
+#define __MMCAMCORDER_MAX_WIDTH                 8192
+#define __MMCAMCORDER_MAX_HEIGHT                8192
 
 #define FPUTC_CHECK(x_char, x_file) \
 { \
@@ -1216,6 +1218,7 @@ gboolean _mmcamcorder_msg_callback(void *data)
 
        /* remove item from msg data */
        if (hcamcorder->msg_data) {
+               /*_mmcam_dbg_log("remove item %p", item);*/
                hcamcorder->msg_data = g_list_remove(hcamcorder->msg_data, item);
        } else {
                _mmcam_dbg_warn("msg_data is NULL but item[%p] will be removed", item);
@@ -1246,10 +1249,9 @@ MSG_CALLBACK_DONE:
        } else if (item->id == MM_MESSAGE_CAMCORDER_VIDEO_CAPTURED || item->id == MM_MESSAGE_CAMCORDER_AUDIO_CAPTURED) {
                MMCamRecordingReport *report = (MMCamRecordingReport *)item->param.data;
                if (report) {
-                       if (report->recording_filename)
-                               SAFE_G_FREE(report->recording_filename);
-
-                       SAFE_G_FREE(report);
+                       SAFE_G_FREE(report->recording_filename);
+                       g_free(report);
+                       report = NULL;
                        item->param.data = NULL;
                }
        }
@@ -1861,7 +1863,7 @@ gboolean _mmcamcorder_encode_jpeg(void *src_data, unsigned int src_width, unsign
                return FALSE;
        }
 
-       ret = mm_util_jpeg_encode_to_memory(result_data, (int *)result_length,
+       ret = mm_util_jpeg_encode_to_memory(result_data, result_length,
                converted_src, src_width, src_height, jpeg_format, jpeg_quality);
 
        if (converted_src && (converted_src != src_data)) {
@@ -2240,6 +2242,12 @@ static gboolean _mmcamcorder_convert_NV12_to_I420(unsigned char *src, guint widt
                return FALSE;
        }
 
+       /* buffer overflow prevention check */
+       if (width > __MMCAMCORDER_MAX_WIDTH || height > __MMCAMCORDER_MAX_HEIGHT) {
+               _mmcam_dbg_err("too large size %d x %d", width, height);
+               return FALSE;
+       }
+
        dst_size = (width * height * 3) >> 1;
 
        _mmcam_dbg_log("NV12 -> I420 : %dx%d, dst size %d", width, height, dst_size);