commit 4e854bf585054e909e1effb9ffcef32a6d001f04
author Nick Kralevich <nnk@google.com> Sat Jun 13 17:03:06 2015 -0700
committer Chad Brubaker <cbrubaker@google.com> Fri Aug 21 11:31:28 2015 -0700
tree d5234e26c320d02b5ed61c916c87f0d316ecf2a8
parent d7c2effc0494a88b8b11ecf3c01f883b04c465e1

don't trigger an integer underflow when decrementing.

When decrementing "i", eventually i will equal zero. When that
happens, i-- underflows. This causes a crash when code which uses
clang's -fsanitize=unsigned-integer-overflow is run.

Avoid trigging an unsigned integer underflow.

Change-Id: I61709cb01f56fdb36d631aa95579e8bd09cafd12
(cherry picked from commit 938e2b34b16c3c1fd29c753eeb53ee95a2b2e2b3)

media/libstagefright/ACodec.cpp

diff --git a/media/libstagefright/ACodec.cpp b/media/libstagefright/ACodec.cpp
index d298cb1..3239036 100644
--- a/media/libstagefright/ACodec.cpp
+++ b/media/libstagefright/ACodec.cpp
@@ -1003,7 +1003,8 @@
 }
 
 status_t ACodec::freeBuffersOnPort(OMX_U32 portIndex) {
-    for (size_t i = mBuffers[portIndex].size(); i-- > 0;) {
+    for (size_t i = mBuffers[portIndex].size(); i > 0;) {
+        i--;
         CHECK_EQ((status_t)OK, freeBuffer(portIndex, i));
     }
 
@@ -1013,7 +1014,8 @@
 }
 
 status_t ACodec::freeOutputBuffersNotOwnedByComponent() {
-    for (size_t i = mBuffers[kPortIndexOutput].size(); i-- > 0;) {
+    for (size_t i = mBuffers[kPortIndexOutput].size(); i > 0;) {
+        i--;
         BufferInfo *info =
             &mBuffers[kPortIndexOutput].editItemAt(i);
 

media/libstagefright/MediaCodecList.cpp

diff --git a/media/libstagefright/MediaCodecList.cpp b/media/libstagefright/MediaCodecList.cpp
index ff3ede4..c0887ef 100644
--- a/media/libstagefright/MediaCodecList.cpp
+++ b/media/libstagefright/MediaCodecList.cpp
@@ -123,7 +123,8 @@
         return;
     }
 
-    for (size_t i = mCodecInfos.size(); i-- > 0;) {
+    for (size_t i = mCodecInfos.size(); i > 0;) {
+        i--;
         const MediaCodecInfo &info = *mCodecInfos.itemAt(i).get();
 
         if (info.mCaps.size() == 0) {

media/libstagefright/foundation/AHierarchicalStateMachine.cpp

diff --git a/media/libstagefright/foundation/AHierarchicalStateMachine.cpp b/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
index 5f7c70d..b837f66 100644
--- a/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
+++ b/media/libstagefright/foundation/AHierarchicalStateMachine.cpp
@@ -109,7 +109,8 @@
         A.editItemAt(i)->stateExited();
     }
 
-    for (size_t i = B.size(); i-- > 0;) {
+    for (size_t i = B.size(); i > 0;) {
+        i--;
         B.editItemAt(i)->stateEntered();
     }
 }

media/libstagefright/foundation/ALooperRoster.cpp

diff --git a/media/libstagefright/foundation/ALooperRoster.cpp b/media/libstagefright/foundation/ALooperRoster.cpp
index 2d57aee..f4163b2 100644
--- a/media/libstagefright/foundation/ALooperRoster.cpp
+++ b/media/libstagefright/foundation/ALooperRoster.cpp
@@ -80,7 +80,8 @@
     {
         Mutex::Autolock autoLock(mLock);
 
-        for (size_t i = mHandlers.size(); i-- > 0;) {
+        for (size_t i = mHandlers.size(); i > 0;) {
+            i--;
             const HandlerInfo &info = mHandlers.valueAt(i);
 
             sp<ALooper> looper = info.mLooper.promote();