AudioFlinger: Fix getInputBufferSize() corruption
The uninitialized audio_config_t has a .frame_count which is typically not used by HALs for this calculation. However, in the case where the HAL does use this, it can be any 32-bit value. At best the HAL treats this as invalid or ignores it, but at worst the HAL casts to uint32_t and causes the caller to request a ridiculous amount of memory, leading to the process being killed with SIGABRT. Fix: 146119742 Bug: 144245613 Bug: 144245318 Bug: 144000030 Test: atest AudioRecord_BufferSizeTest Change-Id: I41714cb2058a6fe7a6a9f55b1fd7c8d862d69351
Loading
Please register or sign in to comment