Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 039c27ae authored by Chad Brubaker's avatar Chad Brubaker
Browse files

Fix benign overflow in AudioTrack 

two uint32_t's were being used in a computation that could be negative,
cast to int32_t before the subtraction to prevent incorrect overflow
detection.

Change-Id: I33c5ef79a0ebbba055daa0ea041b42229d0c3152
parent 6f5a43f4

media/libmedia/AudioTrack.cpp

+6 −6
Original line number Diff line number Diff line
@@ -1906,8 +1906,7 @@ uint32_t AudioTrack::updateAndGetPosition_l() 
{

    // This is the sole place to read server consumed frames

    uint32_t newServer = mProxy->getPosition();

    int32_t delta = newServer - mServer;

    mServer = newServer;

    uint32_t delta = newServer > mServer ? newServer - mServer : 0;

    // TODO There is controversy about whether there can be "negative jitter" in server position.

    //      This should be investigated further, and if possible, it should be addressed.

    //      A more definite failure mode is infrequent polling by client.
@@ -1916,11 +1915,12 @@ uint32_t AudioTrack::updateAndGetPosition_l() 
    //      That should ensure delta never goes negative for infrequent polling

    //      unless the server has more than 2^31 frames in its buffer,

    //      in which case the use of uint32_t for these counters has bigger issues.

    if (delta < 0) {

        ALOGE("detected illegal retrograde motion by the server: mServer advanced by %d", delta);

        delta = 0;

    if (newServer < mServer) {

        ALOGE("detected illegal retrograde motion by the server: mServer advanced by %d",

              (int32_t) newServer - mServer);

    }

    return mPosition += (uint32_t) delta;

    mServer = newServer;

    return mPosition += delta;

}



status_t AudioTrack::setParameters(const String8& keyValuePairs)