| commit | c63899dfc87e92efc25cd0a994ab9896e47315b4 | [log] [tgz] |
|---|---|---|
| author | TreeHugger Robot <treehugger-gerrit@google.com> | Tue Oct 05 17:21:58 2021 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue Oct 05 17:21:58 2021 +0000 |
| tree | 4fdb78df44ae88d3baa9ac02dd14fc592434fe7e | |
| parent | 35d835f934af5f09639e707895d5783ab1389218 [diff] | |
| parent | 1b2108292087f19a720b403079da02756aac0e79 [diff] |
Merge "C2SoftMp3Dec: fix OOB write in output buffer" into qt-dev am: 1b21082920 Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/15919336 Change-Id: I0486884d67045ec6941a73517ffb94fe22bdb0a5
diff --git a/media/codec2/components/mp3/C2SoftMp3Dec.cpp b/media/codec2/components/mp3/C2SoftMp3Dec.cpp index 5ba7e3d..3984f62 100644 --- a/media/codec2/components/mp3/C2SoftMp3Dec.cpp +++ b/media/codec2/components/mp3/C2SoftMp3Dec.cpp
@@ -405,7 +405,7 @@ mConfig->inputBufferCurrentLength = (inSize - inPos); mConfig->inputBufferMaxLength = 0; mConfig->inputBufferUsedLength = 0; - mConfig->outputFrameSize = (calOutSize - outSize); + mConfig->outputFrameSize = (calOutSize - outSize) / sizeof(int16_t); mConfig->pOutputBuffer = reinterpret_cast<int16_t *> (wView.data() + outSize); ERROR_CODE decoderErr;