Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 9899ff7f authored by Robin Lee's avatar Robin Lee
Browse files

AudioFlinger: Fix getInputBufferSize() corruption

The uninitialized audio_config_t has a .frame_count which is typically
not used by HALs for this calculation. However, in the case where the
HAL does use this, it can be any 32-bit value.

At best the HAL treats this as invalid or ignores it, but at worst the HAL
casts to uint32_t and causes the caller to request a ridiculous amount of
memory, leading to the process being killed with SIGABRT.

Fix: 146119742
Bug: 144245613
Bug: 144245318
Bug: 144000030
Test: atest AudioRecord_BufferSizeTest
Change-Id: I41714cb2058a6fe7a6a9f55b1fd7c8d862d69351
parent b7b2f5d8
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment