Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7ec47840 authored by Harish Mahendrakar's avatar Harish Mahendrakar Committed by Ray Essick
Browse files

OpusHeader: Fix OOB write in WriteOpusHeaders() 

writeOpusHeader() was called with a wrong output size which was leading
to a OOB write in memset

Test: Manually tested with AMediaCodec based application for opus encode
Bug: 132794989

Change-Id: I7e1daf935f94d80dc2655ce732fda8cde104947c
parent 243787c8

media/libstagefright/foundation/OpusHeader.cpp

+1 −1
Original line number Diff line number Diff line
@@ -208,7 +208,7 @@ int WriteOpusHeaders(const OpusHeader &header, int inputSampleRate, 
    headerLen += AOPUS_LENGTH_SIZE;



    int headerSize = WriteOpusHeader(header, inputSampleRate, output + headerLen,

        outputSize);

        outputSize - headerLen);

    if (headerSize < 0) {

        ALOGD("%s: WriteOpusHeader failed", __func__);

        return -1;