commit 622ff28c492bacd7dcd2caa52386be8d7ce5276c
author Chad Brubaker <cbrubaker@google.com> Tue Aug 11 15:21:02 2015 -0700
committer Chad Brubaker <cbrubaker@google.com> Fri Aug 21 11:31:28 2015 -0700
tree 8aa37b007ead716e6b81e7c53de7657f79aad72f
parent 5915ce01d5aeaa78ca07d2b443366788d284e448

Fix benign unsigned integer overflow

Bug:23110888
Change-Id: Ibd6f1c7a9204cf584536c1ee63f6a8e5c6e4aa59
(cherry picked from commit 69c1e038717d3462ea5991425ba009f0aed148d2)

media/libstagefright/DataURISource.cpp

diff --git a/media/libstagefright/DataURISource.cpp b/media/libstagefright/DataURISource.cpp
index 2c39314..2a61c3a 100644
--- a/media/libstagefright/DataURISource.cpp
+++ b/media/libstagefright/DataURISource.cpp
@@ -42,7 +42,8 @@
         AString encoded(commaPos + 1);
 
         // Strip CR and LF...
-        for (size_t i = encoded.size(); i-- > 0;) {
+        for (size_t i = encoded.size(); i > 0;) {
+            i--;
             if (encoded.c_str()[i] == '\r' || encoded.c_str()[i] == '\n') {
                 encoded.erase(i, 1);
             }

media/libstagefright/OMXCodec.cpp

diff --git a/media/libstagefright/OMXCodec.cpp b/media/libstagefright/OMXCodec.cpp
index 4d30069..4434770 100644
--- a/media/libstagefright/OMXCodec.cpp
+++ b/media/libstagefright/OMXCodec.cpp
@@ -2837,7 +2837,8 @@
 
     status_t stickyErr = OK;
 
-    for (size_t i = buffers->size(); i-- > 0;) {
+    for (size_t i = buffers->size(); i > 0;) {
+        i--;
         BufferInfo *info = &buffers->editItemAt(i);
 
         if (onlyThoseWeOwn && info->mStatus == OWNED_BY_COMPONENT) {