Fix global-buffer-overflow in voAWB_Copy.
Copy() in frameworks/av/media/libstagefright/codecs/amrwbenc/src/util.c always
overreads the buffer by 4 bytes to the right, which, if we are very unlucky,
can even hit an unmapped memory page (in this case it is just a global
variable).
Bug: 22331081
Change-Id: I3d5d7f94c7248967518bf4d0faf34c364e431135
diff --git a/media/libstagefright/codecs/amrwbenc/src/util.c b/media/libstagefright/codecs/amrwbenc/src/util.c
index 76ab1b1..0369d78 100644
--- a/media/libstagefright/codecs/amrwbenc/src/util.c
+++ b/media/libstagefright/codecs/amrwbenc/src/util.c
@@ -60,13 +60,11 @@
*y++ = temp1;
}
num = (Word32)(L>>1);
- temp1 = *x++;
- temp2 = *x++;
do{
- *y++ = temp1;
- *y++ = temp2;
temp1 = *x++;
temp2 = *x++;
+ *y++ = temp1;
+ *y++ = temp2;
}while(--num!=0);
}