| commit | 4b9ea8185cb76f3285f7e91fbc30bfdd8d10fd79 | [log] [tgz] |
|---|---|---|
| author | TreeHugger Robot <treehugger-gerrit@google.com> | Tue Oct 05 17:48:51 2021 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue Oct 05 17:48:51 2021 +0000 |
| tree | cd37bfaaebf570cfd06a4ba3274e8ad3ac4bc186 | |
| parent | 1f734b0f36984f1f163918e73ae682a4ff911395 [diff] | |
| parent | 62985ff9b8feac4a59f1e30b6d814d23dd3d5ff5 [diff] |
Merge "C2SoftMp3Dec: fix OOB write in output buffer" into qt-dev am: 1b21082920 am: c63899dfc8 am: 62985ff9b8 Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/15919336 Change-Id: I9cc0639d9367bfd876fcf263344b9205759d7b13
diff --git a/media/codec2/components/mp3/C2SoftMp3Dec.cpp b/media/codec2/components/mp3/C2SoftMp3Dec.cpp index 5ba7e3d..3984f62 100644 --- a/media/codec2/components/mp3/C2SoftMp3Dec.cpp +++ b/media/codec2/components/mp3/C2SoftMp3Dec.cpp
@@ -405,7 +405,7 @@ mConfig->inputBufferCurrentLength = (inSize - inPos); mConfig->inputBufferMaxLength = 0; mConfig->inputBufferUsedLength = 0; - mConfig->outputFrameSize = (calOutSize - outSize); + mConfig->outputFrameSize = (calOutSize - outSize) / sizeof(int16_t); mConfig->pOutputBuffer = reinterpret_cast<int16_t *> (wView.data() + outSize); ERROR_CODE decoderErr;