diff options
| author | Marco Nelissen <marcone@google.com> | 2015-05-01 16:18:26 -0700 |
|---|---|---|
| committer | Marco Nelissen <marcone@google.com> | 2015-05-05 09:02:29 -0700 |
| commit | 30d77e2c75c1973f9fb363717af92cf640685da3 (patch) | |
| tree | 99442124dbc044f9d985e10afd65355923d563e4 | |
| parent | 6429079345404932c5be5956efc7154390d2ed0e (diff) | |
| download | frameworks_av-30d77e2c75c1973f9fb363717af92cf640685da3.zip frameworks_av-30d77e2c75c1973f9fb363717af92cf640685da3.tar.gz frameworks_av-30d77e2c75c1973f9fb363717af92cf640685da3.tar.bz2 | |
Fix potential buffer overrun
The "samples" parameter indicates the max number of sample tuples, not
the max number of samples.
Bug: 16183063
Change-Id: I5347497bbbe65910b8489d354e985ebc90d65516
| -rw-r--r-- | media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp index 51bb958..c1c5e64 100644 --- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp +++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp @@ -357,7 +357,7 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) { } else { numFrames = vorbis_dsp_pcmout( mState, (int16_t *)outHeader->pBuffer, - kMaxNumSamplesPerBuffer); + (kMaxNumSamplesPerBuffer / mVi->channels)); if (numFrames < 0) { ALOGE("vorbis_dsp_pcmout returned %d", numFrames); |