commit ba329b1662b293b34f9a8054136cd49c0d3fba80
author Mikhail Naganov <mnaganov@google.com> Tue Mar 26 17:04:53 2019 -0700
committer Mikhail Naganov <mnaganov@google.com> Wed Mar 27 00:08:15 2019 +0000
tree 3a2c7bba4d24638e89c8a082ed95bdcdb45e60a5
parent c8ea1c1b81990a32c0ea86501351ef434806711f

stagefright: Fix overflow in AudioSource::dataCallback

Bug: 129158294
Test: atest CtsMediaTestCases:MediaRecorderTest
  on cuttlefish

Change-Id: I01204576fc0c5091317d723bc5d5f519b058cafc

media/libstagefright/AudioSource.cpp

diff --git a/media/libstagefright/AudioSource.cpp b/media/libstagefright/AudioSource.cpp
index 5194e03..a713900 100644
--- a/media/libstagefright/AudioSource.cpp
+++ b/media/libstagefright/AudioSource.cpp
@@ -385,11 +385,11 @@
     }
     mLastFrameTimestampUs = timeUs;
 
-    size_t numLostBytes = 0;
+    uint64_t numLostBytes = 0; // AudioRecord::getInputFramesLost() returns uint32_t
     if (mNumFramesReceived > 0) {  // Ignore earlier frame lost
         // getInputFramesLost() returns the number of lost frames.
         // Convert number of frames lost to number of bytes lost.
-        numLostBytes = mRecord->getInputFramesLost() * mRecord->frameSize();
+        numLostBytes = (uint64_t)mRecord->getInputFramesLost() * mRecord->frameSize();
     }
 
     CHECK_EQ(numLostBytes & 1, 0u);
@@ -397,11 +397,11 @@
     if (numLostBytes > 0) {
         // Loss of audio frames should happen rarely; thus the LOGW should
         // not cause a logging spam
-        ALOGW("Lost audio record data: %zu bytes", numLostBytes);
+        ALOGW("Lost audio record data: %" PRIu64 " bytes", numLostBytes);
     }
 
     while (numLostBytes > 0) {
-        size_t bufferSize = numLostBytes;
+        uint64_t bufferSize = numLostBytes;
         if (numLostBytes > kMaxBufferSize) {
             numLostBytes -= kMaxBufferSize;
             bufferSize = kMaxBufferSize;