RESTRICT AUTOMERGE: aaudio: Fix converting negative FIFO counters to index

The index into the FIFO is calculated by using:

    counter % capacity

But the counter is signed and when it is negative the
modulo can have a negative result. That can cause
a negative array index and an access out of bounds.

This is not normally a problem because the counter
is 64 bits and it will not overflow until the audio
has run for a few million years. But a hacker might
be able to modify this internal counter and force
an error.

The solution involves casting to a uint64_t before doing
the modulo.

Note that there may still be a discontinuity when the
counter wraps from -1 to 0. But that will not result
in an out-of-bounds access. It may cause a noise but
an app could simply create a noise directly. So that is
not considered an exploit.

Bug: 120789744
Test: test_atomic_fifo.cpp
Change-Id: I6fe57bcb44528d29b5edb817c592e5e9a8aaf8eb
(cherry picked from commit f4f81427681d2a736fc9b783dd967bc0661cca73)
diff --git a/media/libaaudio/src/fifo/FifoControllerBase.cpp b/media/libaaudio/src/fifo/FifoControllerBase.cpp
index 14a2be1..51a8e34 100644
--- a/media/libaaudio/src/fifo/FifoControllerBase.cpp
+++ b/media/libaaudio/src/fifo/FifoControllerBase.cpp
@@ -38,7 +38,7 @@
 fifo_frames_t FifoControllerBase::getReadIndex() {
     // % works with non-power of two sizes
-    return (fifo_frames_t) (getReadCounter() % mCapacity);
+    return (fifo_frames_t) ((uint64_t)getReadCounter() % mCapacity);
 void FifoControllerBase::advanceReadIndex(fifo_frames_t numFrames) {
@@ -51,7 +51,7 @@
 fifo_frames_t FifoControllerBase::getWriteIndex() {
     // % works with non-power of two sizes
-    return (fifo_frames_t) (getWriteCounter() % mCapacity);
+    return (fifo_frames_t) ((uint64_t)getWriteCounter() % mCapacity);
 void FifoControllerBase::advanceWriteIndex(fifo_frames_t numFrames) {