don't trigger an integer underflow when decrementing.

When decrementing "i", eventually i will equal zero. When that
happens, i-- underflows. This causes a crash when code which uses
clang's -fsanitize=unsigned-integer-overflow is run.

Avoid trigging an unsigned integer underflow.

Change-Id: I61709cb01f56fdb36d631aa95579e8bd09cafd12

4 files changed, 10 insertions, 5 deletions

diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp
index f7d89e4..527e9cd 100644
--- a/media/libstagefright/ACodec.cpp
+++ b/media/libstagefright/ACodec.cpp
@@ -1396,7 +1396,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() {
 
 status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) {
     status_t err = OK;
-    for (size_t i = mBuffers[portIndex].size(); i-- > 0;) {
+    for (size_t i = mBuffers[portIndex].size(); i > 0;) {
+        i--;
         status_t err2 = freeBuffer(portIndex, i);
         if (err == OK) {
             err = err2;
@@ -1410,7 +1411,8 @@ status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) {
 
 status_t ACodec::freeOutputBuffersNotOwnedByComponent() {
     status_t err = OK;
-    for (size_t i = mBuffers[kPortIndexOutput].size(); i-- > 0;) {
+    for (size_t i = mBuffers[kPortIndexOutput].size(); i > 0;) {
+        i--;
         BufferInfo *info =
             &mBuffers[kPortIndexOutput].editItemAt(i);
 
diff --git a/media/libstagefright/MediaCodecList.cpp b/media/libstagefright/MediaCodecList.cpp
index 3f10be6..a47bfc7 100644
--- a/media/libstagefright/MediaCodecList.cpp
+++ b/media/libstagefright/MediaCodecList.cpp
@@ -220,7 +220,8 @@ void MediaCodecList::parseTopLevelXMLFile(const char *codecs_xml, bool ignore_er
         }
     }
 
-    for (size_t i = mCodecInfos.size(); i-- > 0;) {
+    for (size_t i = mCodecInfos.size(); i > 0;) {
+        i--;
         const MediaCodecInfo &info = *mCodecInfos.itemAt(i).get();
         if (info.mCaps.size() == 0) {
             // No types supported by this component???
diff --git a/media/libstagefright/foundation/AHierarchicalStateMachine.cpp b/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
index 5f7c70d..b837f66 100644
--- a/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
+++ b/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
@@ -109,7 +109,8 @@ void AHierarchicalStateMachine::changeState(const sp<AState> &state) {
         A.editItemAt(i)->stateExited();
     }
 
-    for (size_t i = B.size(); i-- > 0;) {
+    for (size_t i = B.size(); i > 0;) {
+        i--;
         B.editItemAt(i)->stateEntered();
     }
 }
diff --git a/media/libstagefright/foundation/ALooperRoster.cpp b/media/libstagefright/foundation/ALooperRoster.cpp
index 473ce1b..9ed53e7 100644
--- a/media/libstagefright/foundation/ALooperRoster.cpp
+++ b/media/libstagefright/foundation/ALooperRoster.cpp
@@ -79,7 +79,8 @@ void ALooperRoster::unregisterStaleHandlers() {
     {
         Mutex::Autolock autoLock(mLock);
 
-        for (size_t i = mHandlers.size(); i-- > 0;) {
+        for (size_t i = mHandlers.size(); i > 0;) {
+            i--;
             const HandlerInfo &info = mHandlers.valueAt(i);
 
             sp<ALooper> looper = info.mLooper.promote();