commit efa12510317fa8ebbc2f00f1bff45d2805a83e59
author Marco Nelissen <marcone@google.com> Mon Sep 17 12:18:03 2018 -0700
committer Marco Nelissen <marcone@google.com> Mon Sep 17 15:15:42 2018 -0700
tree e37f2c94a6661a632e06a49ab21e4a3faaf7d96a
parent fd1da15b1b1f05a6b431fd4e33dbb3361e2fc773

Fix bug in MediaBufferGroup new buffer allocation

MediaBufferGroup could allocate buffers of size 0, but this
was masked because we pre-allocated many more buffers. Now
that we allocate fewer buffers upfront, it's more likely
to hit this case.

Bug: 29125703
Test: CTS

Change-Id: Iba666f161be6d7c8bf09e1b48b1fd80750685a57

media/libmedia/IMediaSource.cpp

diff --git a/media/libmedia/IMediaSource.cpp b/media/libmedia/IMediaSource.cpp
index f185fd4..e7da488 100644
--- a/media/libmedia/IMediaSource.cpp
+++ b/media/libmedia/IMediaSource.cpp
@@ -186,6 +186,9 @@
         ret = reply.readInt32();
         ALOGV("readMultiple status %d, bufferCount %u, sinceStop %u",
                 ret, bufferCount, mBuffersSinceStop);
+        if (bufferCount && ret == WOULD_BLOCK) {
+            ret = OK;
+        }
         return ret;
     }
 

media/libmediaextractor/MediaBufferGroup.cpp

diff --git a/media/libmediaextractor/MediaBufferGroup.cpp b/media/libmediaextractor/MediaBufferGroup.cpp
index 2a8dd41..62b83cc 100644
--- a/media/libmediaextractor/MediaBufferGroup.cpp
+++ b/media/libmediaextractor/MediaBufferGroup.cpp
@@ -157,11 +157,15 @@
     Mutex::Autolock autoLock(mInternal->mLock);
     for (;;) {
         size_t smallest = requestedSize;
+        size_t biggest = requestedSize;
         MediaBufferBase *buffer = nullptr;
         auto free = mInternal->mBuffers.end();
         for (auto it = mInternal->mBuffers.begin(); it != mInternal->mBuffers.end(); ++it) {
+            const size_t size = (*it)->size();
+            if (size > biggest) {
+                biggest = size;
+            }
             if ((*it)->refcount() == 0) {
-                const size_t size = (*it)->size();
                 if (size >= requestedSize) {
                     buffer = *it;
                     break;
@@ -176,7 +180,8 @@
                 && (free != mInternal->mBuffers.end()
                     || mInternal->mBuffers.size() < mInternal->mGrowthLimit)) {
             // We alloc before we free so failure leaves group unchanged.
-            const size_t allocateSize = requestedSize < SIZE_MAX / 3 * 2 /* NB: ordering */ ?
+            const size_t allocateSize = requestedSize == 0 ? biggest :
+                    requestedSize < SIZE_MAX / 3 * 2 /* NB: ordering */ ?
                     requestedSize * 3 / 2 : requestedSize;
             buffer = new MediaBuffer(allocateSize);
             if (buffer->data() == nullptr) {