Snap for 8730993 from 15bb2977b870495211117548ea132810e8cff7c9 to mainline-tzdata3-release
Change-Id: I84cd4479b00ef488b0451c4cfde73a6030a8fa32
diff --git a/src/jni/rtp/Android.bp b/src/jni/rtp/Android.bp
index ed0117c..325d6b9 100644
--- a/src/jni/rtp/Android.bp
+++ b/src/jni/rtp/Android.bp
@@ -36,6 +36,7 @@
],
shared_libs: [
+ "framework-permission-aidl-cpp",
"libandroid_runtime",
"libaudioclient",
"libaudiofoundation",
@@ -43,13 +44,12 @@
"libcutils",
"liblog",
"libnativehelper",
- "libpermission",
"libstagefright_amrnb_common",
"libutils",
],
static_libs: [
"libgsm",
- "libpermission",
+ "framework-permission-aidl-cpp",
"libstagefright_amrnbdec",
"libstagefright_amrnbenc",
],
diff --git a/src/jni/rtp/AudioGroup.cpp b/src/jni/rtp/AudioGroup.cpp
index eb3b18f..e92e799 100644
--- a/src/jni/rtp/AudioGroup.cpp
+++ b/src/jni/rtp/AudioGroup.cpp
@@ -426,15 +426,17 @@
return;
}
int offset = 12 + ((buffer[0] & 0x0F) << 2);
- // length is guaranteed to be <= buffersize, so it is safe with respect
- // buffer overflow testing as well as offset into uninitialized buffer
- if (offset + 2 + (int)sizeof(uint16_t) > length) {
+ if (offset+2 >= bufferSize) {
ALOGV("invalid buffer offset: %d", offset+2);
return;
}
if ((buffer[0] & 0x10) != 0) {
offset += 4 + (ntohs(*(uint16_t *)&buffer[offset + 2]) << 2);
}
+ if (offset >= bufferSize) {
+ ALOGV("invalid buffer offset: %d", offset);
+ return;
+ }
if ((buffer[0] & 0x20) != 0) {
length -= buffer[length - 1];
}
@@ -826,13 +828,13 @@
track->setCallerName("rtp");
record->setCallerName("rtp");
if (track->set(AUDIO_STREAM_VOICE_CALL, sampleRate, AUDIO_FORMAT_PCM_16_BIT,
- AUDIO_CHANNEL_OUT_MONO, output, AUDIO_OUTPUT_FLAG_NONE, nullptr /*callback*/,
- 0 /*notificationFrames*/, 0 /*sharedBuffer*/,
+ AUDIO_CHANNEL_OUT_MONO, output, AUDIO_OUTPUT_FLAG_NONE, NULL /*callback_t*/,
+ NULL /*user*/, 0 /*notificationFrames*/, 0 /*sharedBuffer*/,
false /*threadCanCallJava*/, AUDIO_SESSION_ALLOCATE,
AudioTrack::TRANSFER_OBTAIN) != NO_ERROR ||
record->set(AUDIO_SOURCE_VOICE_COMMUNICATION, sampleRate, AUDIO_FORMAT_PCM_16_BIT,
- AUDIO_CHANNEL_IN_MONO, input, nullptr /*callback*/, 0 /*notificationFrames*/,
- false /*threadCanCallJava*/, AUDIO_SESSION_ALLOCATE,
+ AUDIO_CHANNEL_IN_MONO, input, NULL /*callback_t*/, NULL /*user*/,
+ 0 /*notificationFrames*/, false /*threadCanCallJava*/, AUDIO_SESSION_ALLOCATE,
AudioRecord::TRANSFER_OBTAIN) != NO_ERROR) {
ALOGE("cannot initialize audio device");
return false;
@@ -903,8 +905,8 @@
status_t status = track->obtainBuffer(&buffer, 1);
if (status == NO_ERROR) {
int offset = sampleCount - toWrite;
- memcpy(buffer.data(), &output[offset], buffer.size());
- toWrite -= buffer.getFrameCount();
+ memcpy(buffer.i8, &output[offset], buffer.size);
+ toWrite -= buffer.frameCount;
track->releaseBuffer(&buffer);
} else if (status != TIMED_OUT && status != WOULD_BLOCK) {
ALOGE("cannot write to AudioTrack");
@@ -919,8 +921,8 @@
status_t status = record->obtainBuffer(&buffer, 1);
if (status == NO_ERROR) {
int offset = sampleCount - toRead;
- memcpy(&input[offset], buffer.data(), buffer.size());
- toRead -= buffer.getFrameCount();
+ memcpy(&input[offset], buffer.i8, buffer.size);
+ toRead -= buffer.frameCount;
record->releaseBuffer(&buffer);
} else if (status != TIMED_OUT && status != WOULD_BLOCK) {
ALOGE("cannot read from AudioRecord");
