Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 278bb563 authored by Hongguang's avatar Hongguang
Browse files

Cast packetSize to uint8_t before using. 

packetSize is int8_t on AIDL HAL, but packet size may be longer than
128, which will cause a HAL crash.

Bug: 191825295
Test: atest android.media.tv.tuner.cts
Test: atest VtsHalTvTunerTargetTest
Change-Id: I9ee52d3cacab40e69f5f01dbe51c397fa09bfea0
parent b728aeb3

tv/tuner/aidl/default/Dvr.cpp

+2 −1
Original line number Diff line number Diff line
@@ -253,7 +253,8 @@ PlaybackStatus Dvr::checkPlaybackStatusChange(uint32_t availableToWrite, uint32_ 
bool Dvr::readPlaybackFMQ(bool isVirtualFrontend, bool isRecording) {

    // Read playback data from the input FMQ

    int size = mDvrMQ->availableToRead();

    int playbackPacketSize = mDvrSettings.get<DvrSettings::Tag::playback>().packetSize;

    uint8_t playbackPacketSize =

            static_cast<uint8_t>(mDvrSettings.get<DvrSettings::Tag::playback>().packetSize);

    vector<int8_t> dataOutputBuffer;

    dataOutputBuffer.resize(playbackPacketSize);

    // Dispatch the packet to the PID matching filter output buffer