X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=src%2Fmm_camcorder_util.c;h=55de4a292aefaa96d41f36fd6ba4e51efe754a08;hb=aa254c75e23e89333f23a3f97d6e4222eb2e3f9e;hp=0e6bc3f9f9b27c4d104ec933c9e1119225f97e54;hpb=0348ed68d6aeccc33ff96f0cc426d53b6e584532;p=platform%2Fcore%2Fmultimedia%2Flibmm-camcorder.git

diff --git a/src/mm_camcorder_util.c b/src/mm_camcorder_util.c
index 0e6bc3f..55de4a2 100644
--- a/src/mm_camcorder_util.c
+++ b/src/mm_camcorder_util.c
@@ -46,6 +46,8 @@
 -----------------------------------------------------------------------*/
 #define TIME_STRING_MAX_LEN                     64
 #define __MMCAMCORDER_CAPTURE_WAIT_TIMEOUT      5
+#define __MMCAMCORDER_MAX_WIDTH                 8192
+#define __MMCAMCORDER_MAX_HEIGHT                8192
 
 #define FPUTC_CHECK(x_char, x_file) \
 { \
@@ -1216,6 +1218,7 @@ gboolean _mmcamcorder_msg_callback(void *data)
 
 	/* remove item from msg data */
 	if (hcamcorder->msg_data) {
+		/*_mmcam_dbg_log("remove item %p", item);*/
 		hcamcorder->msg_data = g_list_remove(hcamcorder->msg_data, item);
 	} else {
 		_mmcam_dbg_warn("msg_data is NULL but item[%p] will be removed", item);
@@ -1246,10 +1249,9 @@ MSG_CALLBACK_DONE:
 	} else if (item->id == MM_MESSAGE_CAMCORDER_VIDEO_CAPTURED || item->id == MM_MESSAGE_CAMCORDER_AUDIO_CAPTURED) {
 		MMCamRecordingReport *report = (MMCamRecordingReport *)item->param.data;
 		if (report) {
-			if (report->recording_filename)
-				SAFE_G_FREE(report->recording_filename);
-
-			SAFE_G_FREE(report);
+			SAFE_G_FREE(report->recording_filename);
+			g_free(report);
+			report = NULL;
 			item->param.data = NULL;
 		}
 	}
@@ -1861,7 +1863,7 @@ gboolean _mmcamcorder_encode_jpeg(void *src_data, unsigned int src_width, unsign
 		return FALSE;
 	}
 
-	ret = mm_util_jpeg_encode_to_memory(result_data, (int *)result_length,
+	ret = mm_util_jpeg_encode_to_memory(result_data, result_length,
 		converted_src, src_width, src_height, jpeg_format, jpeg_quality);
 
 	if (converted_src && (converted_src != src_data)) {
@@ -2240,6 +2242,12 @@ static gboolean _mmcamcorder_convert_NV12_to_I420(unsigned char *src, guint widt
 		return FALSE;
 	}
 
+	/* buffer overflow prevention check */
+	if (width > __MMCAMCORDER_MAX_WIDTH || height > __MMCAMCORDER_MAX_HEIGHT) {
+		_mmcam_dbg_err("too large size %d x %d", width, height);
+		return FALSE;
+	}
+
 	dst_size = (width * height * 3) >> 1;
 
 	_mmcam_dbg_log("NV12 -> I420 : %dx%d, dst size %d", width, height, dst_size);