Commit dae006d1 authored Jul 07, 2015 by Evgenii Stepanov

Fix global-buffer-overflow in voAWB_Copy.

Copy() in frameworks/av/media/libstagefright/codecs/amrwbenc/src/util.c always
overreads the buffer by 4 bytes to the right, which, if we are very unlucky,
can even hit an unmapped memory page (in this case it is just a global
variable).

Bug: 22331081
Change-Id: I3d5d7f94c7248967518bf4d0faf34c364e431135

parent 37009e46

media/libstagefright/codecs/amrwbenc/src/util.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -60,13 +60,11 @@ void Copy(
		*y++ = temp1;
		}
		num = (Word32)(L>>1);
		do{
		temp1 = *x++;
		temp2 = *x++;
		do{
		*y++ = temp1;
		*y++ = temp2;
		temp1 = *x++;
		temp2 = *x++;
		}while(--num!=0);
		}