Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e854bf5 authored by Nick Kralevich's avatar Nick Kralevich Committed by Chad Brubaker
Browse files

don't trigger an integer underflow when decrementing. 

When decrementing "i", eventually i will equal zero. When that
happens, i-- underflows. This causes a crash when code which uses
clang's -fsanitize=unsigned-integer-overflow is run.

Avoid trigging an unsigned integer underflow.

Change-Id: I61709cb01f56fdb36d631aa95579e8bd09cafd12
(cherry picked from commit 938e2b34)
parent d7c2effc

media/libstagefright/ACodec.cpp

+4 −2
Original line number Diff line number Diff line
@@ -1003,7 +1003,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() { 
}



status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) {

    for (size_t i = mBuffers[portIndex].size(); i-- > 0;) {

    for (size_t i = mBuffers[portIndex].size(); i > 0;) {

        i--;

        CHECK_EQ((status_t)OK, freeBuffer(portIndex, i));

    }
@@ -1013,7 +1014,8 @@ status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) { 
}



status_t ACodec::freeOutputBuffersNotOwnedByComponent() {

    for (size_t i = mBuffers[kPortIndexOutput].size(); i-- > 0;) {

    for (size_t i = mBuffers[kPortIndexOutput].size(); i > 0;) {

        i--;

        BufferInfo *info =

            &mBuffers[kPortIndexOutput].editItemAt(i);

media/libstagefright/MediaCodecList.cpp

+2 −1
Original line number Diff line number Diff line
@@ -123,7 +123,8 @@ void MediaCodecList::parseTopLevelXMLFile(const char *codecs_xml) { 
        return;

    }



    for (size_t i = mCodecInfos.size(); i-- > 0;) {

    for (size_t i = mCodecInfos.size(); i > 0;) {

        i--;

        const MediaCodecInfo &info = *mCodecInfos.itemAt(i).get();



        if (info.mCaps.size() == 0) {

media/libstagefright/foundation/AHierarchicalStateMachine.cpp

+2 −1
Original line number Diff line number Diff line
@@ -109,7 +109,8 @@ void AHierarchicalStateMachine::changeState(const sp<AState> &state) { 
        A.editItemAt(i)->stateExited();

    }



    for (size_t i = B.size(); i-- > 0;) {

    for (size_t i = B.size(); i > 0;) {

        i--;

        B.editItemAt(i)->stateEntered();

    }

}

media/libstagefright/foundation/ALooperRoster.cpp

+2 −1
Original line number Diff line number Diff line
@@ -80,7 +80,8 @@ void ALooperRoster::unregisterStaleHandlers() { 
    {

        Mutex::Autolock autoLock(mLock);



        for (size_t i = mHandlers.size(); i-- > 0;) {

        for (size_t i = mHandlers.size(); i > 0;) {

            i--;

            const HandlerInfo &info = mHandlers.valueAt(i);



            sp<ALooper> looper = info.mLooper.promote();