Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 42c95cf6 authored by Treehugger Robot's avatar Treehugger Robot Committed by Android (Google) Code Review
Browse files

Merge "Fix out of bounds read and write in onQueueFilled in outQueue" into rvc-dev

parents 00371b64 208e430b

media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp

+5 −2
Original line number Diff line number Diff line
@@ -312,9 +312,12 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { 
        outHeader->nFilledLen = frameSize;



        List<BufferInfo *>::iterator it = outQueue.begin();

        while ((*it)->mHeader != outHeader) {

        while (it != outQueue.end() && (*it)->mHeader != outHeader) {

             ++it;

        }

        if (it == outQueue.end()) {

            return;

        }



        BufferInfo *outInfo = *it;

        outInfo->mOwnedByUs = false;