Merge "audio: check for negative sizes in conversion" into pi-dev am: 5c2b3fc0b4 (fd572bb4) · Commits · e / os / android_frameworks_av

media/libaaudio/src/utility/AAudioUtilities.cpp

+12 −7

Original line number	Diff line number	Diff line
		@@ -599,14 +599,19 @@ audio_source_t AAudioConvert_inputPresetToAudioSource(aaudio_input_preset_t pres
		int32_t AAudioConvert_framesToBytes(int32_t numFrames,
		int32_t bytesPerFrame,
		int32_t *sizeInBytes) {
		// TODO implement more elegantly
		const int32_t maxChannels = 256; // ridiculously large
		const int32_t maxBytesPerFrame = maxChannels * sizeof(float);
		// Prevent overflow by limiting multiplicands.
		if (bytesPerFrame > maxBytesPerFrame \|\| numFrames > (0x3FFFFFFF / maxBytesPerFrame)) {
		*sizeInBytes = 0;

		if (numFrames < 0 \|\| bytesPerFrame < 0) {
		ALOGE("negative size, numFrames = %d, frameSize = %d", numFrames, bytesPerFrame);
		return AAUDIO_ERROR_OUT_OF_RANGE;
		}

		// Prevent numeric overflow.
		if (numFrames > (INT32_MAX / bytesPerFrame)) {
		ALOGE("size overflow, numFrames = %d, frameSize = %d", numFrames, bytesPerFrame);
		return AAUDIO_ERROR_OUT_OF_RANGE;
		}

		sizeInBytes = numFrames bytesPerFrame;
		return AAUDIO_OK;
		}

+5 −3

Original line number	Diff line number	Diff line
		@@ -196,9 +196,11 @@ private:

		/**
		* Calculate the number of bytes and prevent numeric overflow.
		* The *sizeInBytes will be set to zero if there is an error.
		*
		* @param numFrames frame count
		* @param bytesPerFrame size of a frame in bytes
		* @param sizeInBytes total size in bytes
		* @param sizeInBytes pointer to a variable to receive total size in bytes
		* @return AAUDIO_OK or negative error, eg. AAUDIO_ERROR_OUT_OF_RANGE
		*/
		int32_t AAudioConvert_framesToBytes(int32_t numFrames,