From 938e2b34b16c3c1fd29c753eeb53ee95a2b2e2b3 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Sat, 13 Jun 2015 17:03:06 -0700 Subject: don't trigger an integer underflow when decrementing. When decrementing "i", eventually i will equal zero. When that happens, i-- underflows. This causes a crash when code which uses clang's -fsanitize=unsigned-integer-overflow is run. Avoid trigging an unsigned integer underflow. Change-Id: I61709cb01f56fdb36d631aa95579e8bd09cafd12 --- media/libstagefright/ACodec.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'media/libstagefright/ACodec.cpp') diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp index f7d89e4..527e9cd 100644 --- a/media/libstagefright/ACodec.cpp +++ b/media/libstagefright/ACodec.cpp @@ -1396,7 +1396,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() { status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) { status_t err = OK; - for (size_t i = mBuffers[portIndex].size(); i-- > 0;) { + for (size_t i = mBuffers[portIndex].size(); i > 0;) { + i--; status_t err2 = freeBuffer(portIndex, i); if (err == OK) { err = err2; @@ -1410,7 +1411,8 @@ status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) { status_t ACodec::freeOutputBuffersNotOwnedByComponent() { status_t err = OK; - for (size_t i = mBuffers[kPortIndexOutput].size(); i-- > 0;) { + for (size_t i = mBuffers[kPortIndexOutput].size(); i > 0;) { + i--; BufferInfo *info = &mBuffers[kPortIndexOutput].editItemAt(i); -- cgit v1.1