Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a7958f9 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Fix out of bounds read and write in onQueueFilled in outQueue" into rvc-dev am: 42c95cf6 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/25575421



Change-Id: I5023a80bf2b1c299715a7136a1455d4ed802f68b
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents b6b779f7 42c95cf6

media/libstagefright/codecs/m4v_h263/dec/SoftMPEG4.cpp

+5 −2
Original line number Diff line number Diff line
@@ -312,9 +312,12 @@ void SoftMPEG4::onQueueFilled(OMX_U32 /* portIndex */) { 
        outHeader->nFilledLen = frameSize;



        List<BufferInfo *>::iterator it = outQueue.begin();

        while ((*it)->mHeader != outHeader) {

        while (it != outQueue.end() && (*it)->mHeader != outHeader) {

             ++it;

        }

        if (it == outQueue.end()) {

            return;

        }



        BufferInfo *outInfo = *it;

        outInfo->mOwnedByUs = false;