commit 5bd984dae517ed5567ee40ea76dced3f2a0834e3
author Andy Hung <hunga@google.com> Mon Jun 12 17:22:46 2017 -0700
committer JP Sugarbroad <jpsugar@google.com> Thu Jul 20 15:25:26 2017 -0700
tree e9ae543edfcce3febbdf5ea6d41d84cfe3eefb33
parent ca0e7f65e7b4ee6fe7c0f022ff4aeb454374e0e4

Track: Check buffer size of static tracks

Merged-In: Ia7edd9a802905214a27961dbcec6352f6ef98f73
Test: Native POC
Bug: 38340117
Change-Id: I633caf563d3607dbe4b9be10be1687efce33469c
(cherry picked from commit f4aeab2bd69bead05ed75ae3254f53a6ab2316b5)

services/audioflinger/Tracks.cpp

diff --git a/services/audioflinger/Tracks.cpp b/services/audioflinger/Tracks.cpp
index aab4ba9..a3f3ea5 100644
--- a/services/audioflinger/Tracks.cpp
+++ b/services/audioflinger/Tracks.cpp
@@ -399,6 +399,21 @@
         mAudioTrackServerProxy = new AudioTrackServerProxy(mCblk, mBuffer, frameCount,
                 mFrameSize, !isExternalTrack(), sampleRate);
     } else {
+        // Is the shared buffer of sufficient size?
+        // (frameCount * mFrameSize) is <= SIZE_MAX, checked in TrackBase.
+        if (sharedBuffer->size() < frameCount * mFrameSize) {
+            // Workaround: clear out mCblk to indicate track hasn't been properly created.
+            mCblk->~audio_track_cblk_t();   // destroy our shared-structure.
+            if (mClient == 0) {
+                free(mCblk);
+            }
+            mCblk = NULL;
+
+            mSharedBuffer.clear(); // release shared buffer early
+            android_errorWriteLog(0x534e4554, "38340117");
+            return;
+        }
+
         mAudioTrackServerProxy = new StaticAudioTrackServerProxy(mCblk, mBuffer, frameCount,
                 mFrameSize);
     }