| commit | 62985ff9b8feac4a59f1e30b6d814d23dd3d5ff5 | [log] [tgz] |
|---|---|---|
| author | TreeHugger Robot <treehugger-gerrit@google.com> | Tue Oct 05 17:36:23 2021 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue Oct 05 17:36:23 2021 +0000 |
| tree | 107eafa1fcc71a9ac3c7910bcb3c1e8c4ea5961c | |
| parent | 65ce2a890e715ce69e6e37c45b3bdd540ea538cc [diff] | |
| parent | c63899dfc87e92efc25cd0a994ab9896e47315b4 [diff] |
Merge "C2SoftMp3Dec: fix OOB write in output buffer" into qt-dev am: 1b21082920 am: c63899dfc8 Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/15919336 Change-Id: I30d5568febbb89a85088f86272437a1b30304499
diff --git a/media/codec2/components/mp3/C2SoftMp3Dec.cpp b/media/codec2/components/mp3/C2SoftMp3Dec.cpp index 5ba7e3d..3984f62 100644 --- a/media/codec2/components/mp3/C2SoftMp3Dec.cpp +++ b/media/codec2/components/mp3/C2SoftMp3Dec.cpp
@@ -405,7 +405,7 @@ mConfig->inputBufferCurrentLength = (inSize - inPos); mConfig->inputBufferMaxLength = 0; mConfig->inputBufferUsedLength = 0; - mConfig->outputFrameSize = (calOutSize - outSize); + mConfig->outputFrameSize = (calOutSize - outSize) / sizeof(int16_t); mConfig->pOutputBuffer = reinterpret_cast<int16_t *> (wView.data() + outSize); ERROR_CODE decoderErr;