commit 283a9d9e15e095493a7d9800667e49169143e7e3
author Jon Eklund <jeklund@motorola.com> Thu Nov 13 09:57:17 2014 -0600
committer Eric Laurent <elaurent@google.com> Thu Nov 13 10:15:58 2014 -0800
tree 896ceebb7e47e1aceec6215aed3a65c564993a63
parent f338fcbae53987a5db77b774049d1128964fe880

AudioRecorder read buffer overflow

Since function was changed from byte-native to short-native,
it's no longer necessary to multiply offset by sizeof(short).

Bug 18367580

Change-Id: I669d860334ba40e46c04e534d7008b9e2401d8cd

core/jni/android_media_AudioRecord.cpp

diff --git a/core/jni/android_media_AudioRecord.cpp b/core/jni/android_media_AudioRecord.cpp
index e38f3d4..d2eb8dd 100644
--- a/core/jni/android_media_AudioRecord.cpp
+++ b/core/jni/android_media_AudioRecord.cpp
@@ -431,7 +431,7 @@
     // read the new audio data from the native AudioRecord object
     const size_t recorderBuffSize = lpRecorder->frameCount()*lpRecorder->frameSize();
     const size_t sizeInBytes = sizeInShorts * sizeof(short);
-    ssize_t readSize = lpRecorder->read(recordBuff + offsetInShorts * sizeof(short),
+    ssize_t readSize = lpRecorder->read(recordBuff + offsetInShorts,
                                         sizeInBytes > recorderBuffSize ?
                                             recorderBuffSize : sizeInBytes);