don't trigger an integer underflow when decrementing.

When decrementing "i", eventually i will equal zero. When that
happens, i-- underflows. This causes a crash when code which uses
clang's -fsanitize=unsigned-integer-overflow is run.

Avoid trigging an unsigned integer underflow.

Change-Id: I61709cb01f56fdb36d631aa95579e8bd09cafd12

2 files changed, 4 insertions, 2 deletions

diff --git a/media/libstagefright/foundation/AHierarchicalStateMachine.cpp b/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
index 5f7c70d..b837f66 100644
--- a/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
+++ b/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
@@ -109,7 +109,8 @@ void AHierarchicalStateMachine::changeState(const sp<AState> &state) {
         A.editItemAt(i)->stateExited();
     }
 
-    for (size_t i = B.size(); i-- > 0;) {
+    for (size_t i = B.size(); i > 0;) {
+        i--;
         B.editItemAt(i)->stateEntered();
     }
 }
diff --git a/media/libstagefright/foundation/ALooperRoster.cpp b/media/libstagefright/foundation/ALooperRoster.cpp
index 473ce1b..9ed53e7 100644
--- a/media/libstagefright/foundation/ALooperRoster.cpp
+++ b/media/libstagefright/foundation/ALooperRoster.cpp
@@ -79,7 +79,8 @@ void ALooperRoster::unregisterStaleHandlers() {
     {
         Mutex::Autolock autoLock(mLock);
 
-        for (size_t i = mHandlers.size(); i-- > 0;) {
+        for (size_t i = mHandlers.size(); i > 0;) {
+            i--;
             const HandlerInfo &info = mHandlers.valueAt(i);
 
             sp<ALooper> looper = info.mLooper.promote();