Fix for the safty check. It checks that nFir21 + jNpoints <= BUF_SIZE,
but when it calls GetByteArrayRegion, it multiplies it by 2 which
defeats the "// safety first" check at the beginning.
diff --git a/media/jni/android_media_ResampleInputStream.cpp b/media/jni/android_media_ResampleInputStream.cpp
index f248557..d965d9a 100644
--- a/media/jni/android_media_ResampleInputStream.cpp
+++ b/media/jni/android_media_ResampleInputStream.cpp
@@ -92,7 +92,7 @@
jint jNpoints) {
// safety first!
- if (nFir21 + jNpoints > BUF_SIZE) {
+ if (nFir21 + jNpoints * 2 > BUF_SIZE) {
throwException(env, "java/lang/IllegalArgumentException",
"FIR+data too long %d", nFir21 + jNpoints);
return;