commit 2bfa8f43d63c64b52b78ec4a721dad5b64e0ac66
author Ivan Lozano <ivanlozano@google.com> Wed Jan 17 20:51:50 2018 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Jan 17 20:51:50 2018 +0000
tree 18d23fcaae03ea30c89aad6c83fa4ab2629c6bc8
parent 1b97976a698b77b880fab967ad47696483c4c6c1
parent ceb30493c7ea9f2c6925e17cc0626396de8f8080

Merge "Fix integer overflow sanitizer in FastThread.cpp."

media/libeffects/visualizer/EffectVisualizer.cpp

diff --git a/media/libeffects/visualizer/EffectVisualizer.cpp b/media/libeffects/visualizer/EffectVisualizer.cpp
index c33f9f5..807f24d 100644
--- a/media/libeffects/visualizer/EffectVisualizer.cpp
+++ b/media/libeffects/visualizer/EffectVisualizer.cpp
@@ -594,7 +594,9 @@
                     deltaSmpl = CAPTURE_BUF_SIZE;
                 }
 
-                int32_t capturePoint = (int32_t)pContext->mCaptureIdx - deltaSmpl;
+                int32_t capturePoint;
+                //capturePoint = (int32_t)pContext->mCaptureIdx - deltaSmpl;
+                __builtin_sub_overflow((int32_t)pContext->mCaptureIdx, deltaSmpl, &capturePoint);
                 // a negative capturePoint means we wrap the buffer.
                 if (capturePoint < 0) {
                     uint32_t size = -capturePoint;

media/libnbaio/NBLog.cpp

diff --git a/media/libnbaio/NBLog.cpp b/media/libnbaio/NBLog.cpp
index 2f639d2..827cba9 100644
--- a/media/libnbaio/NBLog.cpp
+++ b/media/libnbaio/NBLog.cpp
@@ -331,7 +331,8 @@
     *(int*) (buffer + sizeof(entry) + sizeof(HistTsEntry)) = author;
     // Update lengths
     buffer[offsetof(entry, length)] = sizeof(HistTsEntryWithAuthor);
-    buffer[sizeof(buffer) + Entry::kPreviousLengthOffset] = sizeof(HistTsEntryWithAuthor);
+    buffer[offsetof(entry, data) + sizeof(HistTsEntryWithAuthor) + offsetof(ending, length)]
+        = sizeof(HistTsEntryWithAuthor);
     // Write new buffer into FIFO
     dst->write(buffer, sizeof(buffer));
     return EntryIterator(mEntry).next();