From bd278758ef81ac2829eb8c0aba477e31e8ca3efd Mon Sep 17 00:00:00 2001
From: Andreas Huber <andih@google.com>
Date: Thu, 18 Mar 2010 14:03:47 -0700
Subject: [PATCH] Report a runtime error rather than asserting if the amr
 software decoder reads more data than it was given(!)

Change-Id: I0a7ad65051a6663a583ea82da5fc75227dcdbbfa
---
 media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp b/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp
index fbb6598f29726..553be87611f32 100644
--- a/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp
+++ b/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp
@@ -21,6 +21,7 @@
 #include <media/stagefright/MediaBufferGroup.h>
 #include <media/stagefright/MediaDebug.h>
 #include <media/stagefright/MediaDefs.h>
+#include <media/stagefright/MediaErrors.h>
 #include <media/stagefright/MetaData.h>
 
 namespace android {
@@ -161,7 +162,14 @@ status_t AMRNBDecoder::read(
 
     buffer->set_range(0, kNumSamplesPerFrame * sizeof(int16_t));
 
-    CHECK(numBytesRead <= mInputBuffer->range_length());
+    if (numBytesRead > mInputBuffer->range_length()) {
+        // This is bad, should never have happened, but did. Abort now.
+
+        buffer->release();
+        buffer = NULL;
+
+        return ERROR_MALFORMED;
+    }
 
     mInputBuffer->set_range(
             mInputBuffer->range_offset() + numBytesRead,