commit a0a60cced1187d50d7b4cab4e0b87679ac2f4505
author Andreas Huber <andih@google.com> Fri Dec 04 08:45:01 2009 -0800
committer Andreas Huber <andih@google.com> Fri Dec 04 08:47:33 2009 -0800
tree d0c1fe292fbcc4ef71d0090785e1470f95c9461f
parent 3000a016292019e74a9afbd65aa95c669c1c4b94

A certain GetParameter call on both the AMR and WBAMR codecs attempted to illegally write to the parameter block.

omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c

diff --git a/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c b/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c
index 0a9f78a..5760d95 100644
--- a/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c
+++ b/omx/audio/src/openmax_il/nbamr_enc/src/OMX_AmrEncoder.c
@@ -1115,7 +1115,15 @@
         case OMX_IndexParamAudioAmr:
 
                 OMX_PRDSP2(pComponentPrivate->dbg, "%d :: SetParameter OMX_IndexParamAudioAmr \n",__LINE__);
-                pCompAmrParam = (OMX_AUDIO_PARAM_AMRTYPE *)pCompParam;
+
+                // Code below attempts to write to passed-in parameter block,
+                // which not only is illegal (it's supposed to be read-only),
+                // also in this particular case it seems to live in read-only
+                // memory or something.
+                OMX_AUDIO_PARAM_AMRTYPE copy;
+                memcpy(&copy, pCompParam, sizeof(copy));
+                pCompAmrParam = ©
+
                 if(pCompAmrParam->nPortIndex == 0) {         /* 0 means Input port */
                     memcpy(((AMRENC_COMPONENT_PRIVATE*)
                             pHandle->pComponentPrivate)->pcmParams, pCompAmrParam, sizeof(OMX_AUDIO_PARAM_AMRTYPE));

omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c

diff --git a/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c b/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c
index 2cf04f7..17c298b 100644
--- a/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c
+++ b/omx/audio/src/openmax_il/wbamr_enc/src/OMX_WbAmrEncoder.c
@@ -1072,7 +1072,15 @@
     case OMX_IndexParamAudioAmr:
     {
         OMX_PRDSP2(pComponentPrivate->dbg, "OMX_IndexParamAudioAmr");
-        pCompAmrParam = (OMX_AUDIO_PARAM_AMRTYPE *)pCompParam;
+
+        // Code below attempts to write to passed-in parameter block,
+        // which not only is illegal (it's supposed to be read-only),
+        // also in this particular case it seems to live in read-only
+        // memory or something.
+        OMX_AUDIO_PARAM_AMRTYPE copy;
+        memcpy(&copy, pCompParam, sizeof(copy));
+        pCompAmrParam = ©
+
         if(pCompAmrParam->nPortIndex == 0) {         /* 0 means Input port */
             memcpy(((WBAMRENC_COMPONENT_PRIVATE*)
                     pHandle->pComponentPrivate)->pcmParams,