commit 30d77e2c75c1973f9fb363717af92cf640685da3
author Marco Nelissen <marcone@google.com> Fri May 01 16:18:26 2015 -0700
committer Marco Nelissen <marcone@google.com> Tue May 05 09:02:29 2015 -0700
tree 99442124dbc044f9d985e10afd65355923d563e4
parent 6429079345404932c5be5956efc7154390d2ed0e

Fix potential buffer overrun

The "samples" parameter indicates the max number of sample tuples, not
the max number of samples.

Bug: 16183063
Change-Id: I5347497bbbe65910b8489d354e985ebc90d65516

media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp

diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
index 51bb958..c1c5e64 100644
--- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
+++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp
@@ -357,7 +357,7 @@
         } else {
             numFrames = vorbis_dsp_pcmout(
                     mState, (int16_t *)outHeader->pBuffer,
-                    kMaxNumSamplesPerBuffer);
+                    (kMaxNumSamplesPerBuffer / mVi->channels));
 
             if (numFrames < 0) {
                 ALOGE("vorbis_dsp_pcmout returned %d", numFrames);