C2SoftMp3Dec: fix OOB write in output buffer
outputFrameSize, calOutSize and outSize are calculated at 8bit level
However, the library expects outputFrameSize in int16 samples.
One of the initialization of outputFrameSize was in bytes.
This is now corrected.
Test: clusterfuzz generated poc in bug
Test: atest android.mediav2.cts.CodecDecoderTest
Test: atest VtsHalMediaC2V1_0TargetAudioDecTest
Bug: 193363621
Change-Id: Iac62c4e9d77e7f95f2c692f5ea236e7a5c536dcb
(cherry picked from commit dc32721e28e79df4dd2f5bb896bcf586ebeda5e9)
1 file changed