From 30d77e2c75c1973f9fb363717af92cf640685da3 Mon Sep 17 00:00:00 2001 From: Marco Nelissen Date: Fri, 1 May 2015 16:18:26 -0700 Subject: [PATCH] Fix potential buffer overrun The "samples" parameter indicates the max number of sample tuples, not the max number of samples. Bug: 16183063 Change-Id: I5347497bbbe65910b8489d354e985ebc90d65516 --- media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp index 51bb958f71..c1c5e64101 100644 --- a/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp +++ b/media/libstagefright/codecs/vorbis/dec/SoftVorbis.cpp @@ -357,7 +357,7 @@ void SoftVorbis::onQueueFilled(OMX_U32 portIndex) { } else { numFrames = vorbis_dsp_pcmout( mState, (int16_t *)outHeader->pBuffer, - kMaxNumSamplesPerBuffer); + (kMaxNumSamplesPerBuffer / mVi->channels)); if (numFrames < 0) { ALOGE("vorbis_dsp_pcmout returned %d", numFrames); -- 2.11.0