diff --git a/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp b/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp index fb300da2304bd..a11d46bbd1e79 100644 --- a/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp +++ b/media/libstagefright/codecs/amrnb/dec/AMRNBDecoder.cpp @@ -14,6 +14,10 @@ * limitations under the License. */ +//#define LOG_NDEBUG 0 +#define LOG_TAG "AMRNBDecoder" +#include + #include "AMRNBDecoder.h" #include "gsmamr_dec.h" @@ -154,18 +158,24 @@ status_t AMRNBDecoder::read( const uint8_t *inputPtr = (const uint8_t *)mInputBuffer->data() + mInputBuffer->range_offset(); - size_t numBytesRead = + int32_t numBytesRead = AMRDecode(mState, (Frame_Type_3GPP)((inputPtr[0] >> 3) & 0x0f), (UWord8 *)&inputPtr[1], static_cast(buffer->data()), MIME_IETF); + if (numBytesRead == -1 ) { + LOGE("PV AMR decoder AMRDecode() call failed"); + buffer->release(); + buffer = NULL; + return ERROR_MALFORMED; + } ++numBytesRead; // Include the frame type header byte. buffer->set_range(0, kNumSamplesPerFrame * sizeof(int16_t)); - if (numBytesRead > mInputBuffer->range_length()) { + if (static_cast(numBytesRead) > mInputBuffer->range_length()) { // This is bad, should never have happened, but did. Abort now. buffer->release();