commit fd56e81552f10daf76187532a9b6367dfb932864
author Dean Wheatley <dwhea@dolby.com> Fri Nov 06 22:32:21 2020 +1100
committer Andy Hung <hunga@google.com> Sat Nov 07 00:29:16 2020 +0000
tree f933198cb061f749ba7b13d116d00ed15f09adca
parent b7c14e4cd8885a7247ce5c130516368328f5b7b2

Fix signed integer overflow

The operation "mRsmpInRear += framesRead;" would overflow
the 32-bit variables within 12 minutes for MSD HAL StreamIn IEC61937
MAT 2.0 framed streams (that generate 61440 bytes per 20 milliseconds).

Test: enable integer_overflow diagnostics, enable MSD HAL with IEC
      MAT patch, wait for 12 minutes for UBSan crash, and check record
      thread frame counts have exceeded 2^31.
Change-Id: I9925bf39a1e3d910850efef859e0a412962391ac

services/audioflinger/Threads.cpp

diff --git a/services/audioflinger/Threads.cpp b/services/audioflinger/Threads.cpp
index 384ddb5..b143388 100644
--- a/services/audioflinger/Threads.cpp
+++ b/services/audioflinger/Threads.cpp
@@ -7429,7 +7429,7 @@
                         (framesRead - part1) * mFrameSize);
             }
         }
-        rear = mRsmpInRear += framesRead;
+        mRsmpInRear = audio_utils::safe_add_overflow(mRsmpInRear, (int32_t)framesRead);
 
         size = activeTracks.size();