tag 20f77c765767b826d0151991dee2c39cd244b2e8
tagger The Android Open Source Project <initial-contribution@android.com> Tue May 03 10:31:14 2016 -0700
object f1f22e4d7382bd1e8fb5dfc3dec2a3f489126a2f

Android 6.0.1 release 25 (MTC19T)

commit f1f22e4d7382bd1e8fb5dfc3dec2a3f489126a2f
author Jean-Michel Trivi <jmtrivi@google.com> Mon Mar 21 14:12:19 2016 -0700
committer The Android Automerger <android-build@google.com> Fri Mar 25 19:58:27 2016 -0700
tree 1890fa95db14a23bc83aea6eec77568e3f4ff661
parent 2d435aa43323935bd8ed293f4f12cddfdee81eb3

Fix stack corruption happening in aacDecoder_drcExtractAndMap()

In the aacDecoder_drcExtractAndMap() function, self->numThreads
  can be used after having exceeded its intended max value,
  MAX_DRC_THREADS, causing memory to be cleared after the
  threadBs[MAX_DRC_THREADS] array.
The crash is prevented by never using self->numThreads with
  a value equal to or greater than MAX_DRC_THREADS.
A proper fix will be required as there seems to be an issue as
  to which entry in the threadBs array is meant to be initialized
  and used.

Bug 26751339

Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a