diff options
| author | Martin Barbella <mbarbella@chromium.org> | 2015-11-06 13:34:14 -0800 |
|---|---|---|
| committer | Martin Barbella <mbarbella@chromium.org> | 2015-11-06 21:35:39 +0000 |
| commit | a403edc648a4b289422609a7dc7a33bab498f5bf (patch) | |
| tree | 3bf188a219becf6188b731c34139eb01cb225d3d | |
| parent | d35b5d9521359610255d0322bfeaa3f84e3abf7d (diff) | |
| download | chromium_src-a403edc648a4b289422609a7dc7a33bab498f5bf.zip chromium_src-a403edc648a4b289422609a7dc7a33bab498f5bf.tar.gz chromium_src-a403edc648a4b289422609a7dc7a33bab498f5bf.tar.bz2 | |
Fix a potential buffer overflow in audio_decoder_android
TBR=ochang@chromium.org
BUG=529554
Review URL: https://codereview.chromium.org/1393393005
Cr-Commit-Position: refs/heads/master@{#354319}
(cherry picked from commit 9b576e72b78a1286be39137d7e4320915ab07d32)
Review URL: https://codereview.chromium.org/1424443013 .
Cr-Commit-Position: refs/branch-heads/2526@{#341}
Cr-Branched-From: cb947c0153db0ec02a8abbcb3ca086d88bf6006f-refs/heads/master@{#352221}
| -rw-r--r-- | content/renderer/media/android/audio_decoder_android.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/content/renderer/media/android/audio_decoder_android.cc b/content/renderer/media/android/audio_decoder_android.cc index 73a9225..6373ccd 100644 --- a/content/renderer/media/android/audio_decoder_android.cc +++ b/content/renderer/media/android/audio_decoder_android.cc @@ -481,6 +481,9 @@ static void BufferAndCopyPcmDataToBus(int input_fd, file_sample_rate); for (size_t m = 0; m < number_of_samples; m += number_of_channels) { + if (decoded_frames >= number_of_frames) + break; + for (size_t k = 0; k < number_of_channels; ++k) { int16_t sample = decoded_samples[m + k]; destination_bus->channelData(k)[decoded_frames] = |