Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55363176 authored by Bill Yi's avatar Bill Yi
Browse files

Merge commit '813ac23b' into HEAD

parents c25621f0 813ac23b

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+4 −1
Original line number Diff line number Diff line
@@ -3091,7 +3091,10 @@ int Effect_command(effect_handle_t self, 
            //ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM start");



            effect_param_t *p = (effect_param_t *)pCmdData;



            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {

                android_errorWriteLog(0x534e4554, "26347509");

                return -EINVAL;

            }

            if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||

                    cmdSize < (sizeof(effect_param_t) + p->psize) ||

                    pReplyData == NULL || replySize == NULL ||

media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp

+4 −1
Original line number Diff line number Diff line
@@ -1956,7 +1956,10 @@ int Reverb_command(effect_handle_t self, 
            //ALOGV("\tReverb_command cmdCode Case: "

            //        "EFFECT_CMD_GET_PARAM start");

            effect_param_t *p = (effect_param_t *)pCmdData;



            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {

                android_errorWriteLog(0x534e4554, "26347509");

                return -EINVAL;

            }

            if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||

                    cmdSize < (sizeof(effect_param_t) + p->psize) ||

                    pReplyData == NULL || replySize == NULL ||

media/libmedia/ICrypto.cpp

+3 −1
Original line number Diff line number Diff line
@@ -321,7 +321,9 @@ status_t BnCrypto::onTransact( 


            if (overflow || sumSubsampleSizes != totalSize) {

                result = -EINVAL;

            } else if (offset + totalSize > sharedBuffer->size()) {

            } else if (totalSize > sharedBuffer->size()) {

                result = -EINVAL;

            } else if ((size_t)offset > sharedBuffer->size() - totalSize) {

                result = -EINVAL;

            } else {

                result = decrypt(

media/libmediaplayerservice/MediaPlayerService.cpp

+7 −2
Original line number Diff line number Diff line
@@ -1889,8 +1889,13 @@ void MediaPlayerService::AudioOutput::pause() 
void MediaPlayerService::AudioOutput::close()

{

    ALOGV("close");

    sp<AudioTrack> track;

    {

        Mutex::Autolock lock(mLock);

    close_l();

        track = mTrack;

        close_l(); // clears mTrack

    }

    // destruction of the track occurs outside of mutex.

}



void MediaPlayerService::AudioOutput::setVolume(float left, float right)

media/libstagefright/MPEG4Extractor.cpp

+9 −1
Original line number Diff line number Diff line
@@ -4545,7 +4545,15 @@ status_t MPEG4Source::fragmentedRead( 
                    continue;

                }



                CHECK(dstOffset + 4 <= mBuffer->size());

                if (dstOffset > SIZE_MAX - 4 ||

                        dstOffset + 4 > SIZE_MAX - nalLength ||

                        dstOffset + 4 + nalLength > mBuffer->size()) {

                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());

                    android_errorWriteLog(0x534e4554, "26365349");

                    mBuffer->release();

                    mBuffer = NULL;

                    return ERROR_MALFORMED;

                }



                dstData[dstOffset++] = 0;

                dstData[dstOffset++] = 0;