alsa_output: Bounds check snd_pcm_avail_update (attempt #2).

Buggy ALSA drivers can at times return very large values from snd_pcm_avail_update.  There should never be more available frames than total frames in the buffer.

Patch by dgreid@chromium.org:
http://codereview.chromium.org/9963043/

BUG=chromium-os:26151
TEST=Manual, run a flash player looping alongside an aplay stress test and check that the flash video continues to output audio.

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@130812 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 6 insertions, 1 deletions

diff --git a/media/audio/linux/alsa_output.cc b/media/audio/linux/alsa_output.cc
index d940be9..33c1f37 100644
--- a/media/audio/linux/alsa_output.cc
+++ b/media/audio/linux/alsa_output.cc
@@ -651,7 +651,7 @@ snd_pcm_sframes_t AlsaPcmOutputStream::GetAvailableFrames() {
   // Find the number of frames queued in the sound device.
   snd_pcm_sframes_t available_frames =
       wrapper_->PcmAvailUpdate(playback_handle_);
-  if (available_frames  < 0) {
+  if (available_frames < 0) {
     available_frames = wrapper_->PcmRecover(playback_handle_,
                                             available_frames,
                                             kPcmRecoverIsSilent);
@@ -661,6 +661,11 @@ snd_pcm_sframes_t AlsaPcmOutputStream::GetAvailableFrames() {
                << wrapper_->StrError(available_frames);
     return 0;
   }
+  if (static_cast<uint32>(available_frames) > alsa_buffer_frames_) {
+    LOG(ERROR) << "ALSA returned " << available_frames << " of "
+               << alsa_buffer_frames_ << " frames available.";
+    return alsa_buffer_frames_;
+  }
 
   return available_frames;
 }