[conflict] Merge "Add bounds checks in btif_avrcp_audio_track.cc" into tm-dev...

[conflict] Merge "Add bounds checks in btif_avrcp_audio_track.cc" into tm-dev am: 0b68bd68 am: 52d169b1

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23356997



Merged-In: I7a13261429797769cf5b913912a30e249668ac93
Merged-In: I0389f56ae210b4976821e0ceeb21a7a0c2965a62
Change-Id: I0389f56ae210b4976821e0ceeb21a7a0c2965a62
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

system/btif/src/btif_avrcp_audio_track.cc

@@ -171,7 +171,7 @@ static size_t transcodeQ15ToFloat(uint8_t* buffer, size_t length,
   size_t sampleSize = sampleSizeFor(trackHolder);
   size_t i = 0;
   const float scaledGain = trackHolder->gain * kScaleQ15ToFloat;
-  for (; i <= length / sampleSize; i++) {
+  for (; i < std::min(trackHolder->bufferLength, length / sampleSize); i++) {
     trackHolder->buffer[i] = ((int16_t*)buffer)[i] * scaledGain;
   }
   return i * sampleSize;
@@ -182,7 +182,7 @@ static size_t transcodeQ23ToFloat(uint8_t* buffer, size_t length,
   size_t sampleSize = sampleSizeFor(trackHolder);
   size_t i = 0;
   const float scaledGain = trackHolder->gain * kScaleQ23ToFloat;
-  for (; i <= length / sampleSize; i++) {
+  for (; i < std::min(trackHolder->bufferLength, length / sampleSize); i++) {
     size_t offset = i * sampleSize;
     int32_t sample = *((int32_t*)(buffer + offset - 1)) & 0x00FFFFFF;
     trackHolder->buffer[i] = sample * scaledGain;
@@ -195,7 +195,7 @@ static size_t transcodeQ31ToFloat(uint8_t* buffer, size_t length,
   size_t sampleSize = sampleSizeFor(trackHolder);
   size_t i = 0;
   const float scaledGain = trackHolder->gain * kScaleQ31ToFloat;
-  for (; i <= length / sampleSize; i++) {
+  for (; i < std::min(trackHolder->bufferLength, length / sampleSize); i++) {
     trackHolder->buffer[i] = ((int32_t*)buffer)[i] * scaledGain;
   }
   return i * sampleSize;

system/btif/test/btif_avrcp_audio_track_test.cc

@@ -84,7 +84,7 @@ TEST_F(BtifAvrcpAudioTrackTest,
   for (size_t index = 0; index < bufferLength; ++index) {
     data[index] = index;
   }
-  BtifAvrcpAudioTrackWriteData(trackHolder, data, bufferLength - 1);
+  BtifAvrcpAudioTrackWriteData(trackHolder, data, bufferLength);
   const int16_t* dataInt = (int16_t*)data;
   for (size_t index = 0; index < bufferLength / sampleSize; ++index) {
     const float expected = dataInt[index] * scaleQ15ToFloat * gainValue;