Fix audioflinger in overflow sanitized builds.
The loop as constructed in Track::triggerEvents potentially leads to
two unsigned integer overflows on the i = 0 loop.
This refactors the loop to prevent the overflow.
Bug: 30969751
Test: Compiles and device boots.
Change-Id: I7ac3223ab3197f5c475a4d09c99e6f05d0ddb208
Merged-In: I7ac3223ab3197f5c475a4d09c99e6f05d0ddb208
diff --git a/services/audioflinger/Tracks.cpp b/services/audioflinger/Tracks.cpp
index 0f25153..fe93367 100644
--- a/services/audioflinger/Tracks.cpp
+++ b/services/audioflinger/Tracks.cpp
@@ -1101,11 +1101,12 @@
void AudioFlinger::PlaybackThread::Track::triggerEvents(AudioSystem::sync_event_t type)
{
- for (size_t i = 0; i < mSyncEvents.size(); i++) {
+ for (size_t i = 0; i < mSyncEvents.size();) {
if (mSyncEvents[i]->type() == type) {
mSyncEvents[i]->trigger();
mSyncEvents.removeAt(i);
- i--;
+ } else {
+ ++i;
}
}
}