Track: Check buffer size of static tracks

[android-x86/frameworks-av.git] / services / audioflinger / Tracks.cpp

diff --git a/services/audioflinger/Tracks.cpp b/services/audioflinger/Tracks.cpp
index d1bcb0b..bb220c5 100644 (file)
--- a/services/audioflinger/Tracks.cpp
+++ b/services/audioflinger/Tracks.cpp
@@ -367,6 +367,21 @@ AudioFlinger::PlaybackThread::Track::Track(
             mAudioTrackServerProxy = new AudioTrackServerProxy(mCblk, mBuffer, frameCount,
                     mFrameSize);
         } else {
+            // Is the shared buffer of sufficient size?
+            // (frameCount * mFrameSize) is <= SIZE_MAX, checked in TrackBase.
+            if (sharedBuffer->size() < frameCount * mFrameSize) {
+                // Workaround: clear out mCblk to indicate track hasn't been properly created.
+                mCblk->~audio_track_cblk_t();   // destroy our shared-structure.
+                if (mClient == 0) {
+                    free(mCblk);
+                }
+                mCblk = NULL;
+
+                mSharedBuffer.clear(); // release shared buffer early
+                android_errorWriteLog(0x534e4554, "38340117");
+                return;
+            }
+
             mAudioTrackServerProxy = new StaticAudioTrackServerProxy(mCblk, mBuffer, frameCount,
                     mFrameSize);
         }