Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee5995f8 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge "Fix potential overflow in WAV extractor" into qt-dev

parents a26215a1 66c0c427

media/extractors/wav/WAVExtractor.cpp

+7 −7
Original line number Diff line number Diff line
@@ -93,9 +93,9 @@ private: 
    AMediaFormat *mMeta;

    uint16_t mWaveFormat;

    const bool mOutputFloat;

    int32_t mSampleRate;

    int32_t mNumChannels;

    int32_t mBitsPerSample;

    uint32_t mSampleRate;

    uint32_t mNumChannels;

    uint32_t mBitsPerSample;

    off64_t mOffset;

    size_t mSize;

    bool mStarted;
@@ -377,9 +377,9 @@ WAVSource::WAVSource( 
      mOffset(offset),

      mSize(size),

      mStarted(false) {

    CHECK(AMediaFormat_getInt32(mMeta, AMEDIAFORMAT_KEY_SAMPLE_RATE, &mSampleRate));

    CHECK(AMediaFormat_getInt32(mMeta, AMEDIAFORMAT_KEY_CHANNEL_COUNT, &mNumChannels));

    CHECK(AMediaFormat_getInt32(mMeta, AMEDIAFORMAT_KEY_BITS_PER_SAMPLE, &mBitsPerSample));

    CHECK(AMediaFormat_getInt32(mMeta, AMEDIAFORMAT_KEY_SAMPLE_RATE, (int32_t*) &mSampleRate));

    CHECK(AMediaFormat_getInt32(mMeta, AMEDIAFORMAT_KEY_CHANNEL_COUNT, (int32_t*) &mNumChannels));

    CHECK(AMediaFormat_getInt32(mMeta, AMEDIAFORMAT_KEY_BITS_PER_SAMPLE, (int32_t*) &mBitsPerSample));

}



WAVSource::~WAVSource() {
@@ -470,7 +470,7 @@ media_status_t WAVSource::read( 
    }



    const size_t maxBytesAvailable =

        (mCurrentPos - mOffset >= (off64_t)mSize)

        (mCurrentPos < mOffset || mCurrentPos - mOffset >= (off64_t)mSize)

            ? 0 : mSize - (mCurrentPos - mOffset);



    if (maxBytesToRead > maxBytesAvailable) {