commit 11df024f9e4e58c9b46e36a01a61d7e77efd7ec3
author George Burgess IV <gbiv@google.com> Mon Mar 25 12:22:30 2019 -0700
committer android-build-merger <android-build-merger@google.com> Mon Mar 25 12:22:30 2019 -0700
tree 8ed21b5623edd32639b7274be1fa9bef36bfac53
parent 160ddb098c81be8d8b5160612b9c1cfba8d55764
parent a6665ce4808b705b72acac9cab60dbd959297d3e

Merge "amrnb: Fix memory leaks" am: beb800f0c7 am: 7521f507c5
am: a6665ce480

Change-Id: I99293013025b19c9b898ae461689d12df85073be

media/libstagefright/codecs/amrnb/common/src/lsp.cpp

diff --git a/media/libstagefright/codecs/amrnb/common/src/lsp.cpp b/media/libstagefright/codecs/amrnb/common/src/lsp.cpp
index 0e3f772..81d9cde 100644
--- a/media/libstagefright/codecs/amrnb/common/src/lsp.cpp
+++ b/media/libstagefright/codecs/amrnb/common/src/lsp.cpp
@@ -173,7 +173,7 @@
     *st = NULL;
 
     /* allocate memory */
-    if ((s = (lspState *) malloc(sizeof(lspState))) == NULL)
+    if ((s = (lspState *) calloc(sizeof(lspState), 1)) == NULL)
     {
         /* fprintf(stderr, "lsp_init: can not malloc state structure\n"); */
         return -1;
@@ -182,11 +182,13 @@
     /* Initialize quantization state */
     if (0 != Q_plsf_init(&s->qSt))
     {
+        lsp_exit(&s);
         return -1;
     }
 
     if (0 != lsp_reset(s))
     {
+        lsp_exit(&s);
         return -1;
     }
 

media/libstagefright/codecs/amrnb/dec/src/sp_dec.cpp

diff --git a/media/libstagefright/codecs/amrnb/dec/src/sp_dec.cpp b/media/libstagefright/codecs/amrnb/dec/src/sp_dec.cpp
index 2989b74..49cafff 100644
--- a/media/libstagefright/codecs/amrnb/dec/src/sp_dec.cpp
+++ b/media/libstagefright/codecs/amrnb/dec/src/sp_dec.cpp
@@ -268,13 +268,7 @@
     if (Decoder_amr_init(&s->decoder_amrState)
             || Post_Process_reset(&s->postHP_state))
     {
-        Speech_Decode_FrameState *tmp = s;
-        /*
-         *  dereferencing type-punned pointer avoid
-         *  breaking strict-aliasing rules
-         */
-        void** tempVoid = (void**) tmp;
-        GSMDecodeFrameExit(tempVoid);
+        free(s);
         return (-1);
     }