Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b92add32 authored by Chad Brubaker's avatar Chad Brubaker
Browse files

Fix benign unsigned integer overflows in loop conditions 

This is causing an abort when running with unsigned integer overflow
detection, change the code to no longer do i-- when i = 0.

Change-Id: I0ab786cabb3a3d37fa24a3b8da0c35dd475ca273
parent ff867380

media/libstagefright/ACodec.cpp

+4 −2
Original line number Diff line number Diff line
@@ -1321,7 +1321,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() { 
        }



        bool stale = false;

        for (size_t i = mBuffers[kPortIndexOutput].size(); i-- > 0;) {

        for (size_t i = mBuffers[kPortIndexOutput].size(); i > 0;) {

            i--;

            BufferInfo *info = &mBuffers[kPortIndexOutput].editItemAt(i);



            if (info->mGraphicBuffer != NULL &&
@@ -1364,7 +1365,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() { 


    // get oldest undequeued buffer

    BufferInfo *oldest = NULL;

    for (size_t i = mBuffers[kPortIndexOutput].size(); i-- > 0;) {

    for (size_t i = mBuffers[kPortIndexOutput].size(); i > 0;) {

        i--;

        BufferInfo *info =

            &mBuffers[kPortIndexOutput].editItemAt(i);

        if (info->mStatus == BufferInfo::OWNED_BY_NATIVE_WINDOW &&

media/libstagefright/omx/OMXNodeInstance.cpp

+2 −1
Original line number Diff line number Diff line
@@ -1589,7 +1589,8 @@ void OMXNodeInstance::removeActiveBuffer( 
void OMXNodeInstance::freeActiveBuffers() {

    // Make sure to count down here, as freeBuffer will in turn remove

    // the active buffer from the vector...

    for (size_t i = mActiveBuffers.size(); i--;) {

    for (size_t i = mActiveBuffers.size(); i > 0;) {

        i--;

        freeBuffer(mActiveBuffers[i].mPortIndex, mActiveBuffers[i].mID);

    }

}