summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGareth Stockwell <ext-gareth.stockwell@nokia.com>2010-09-01 13:04:10 (GMT)
committerGareth Stockwell <ext-gareth.stockwell@nokia.com>2010-09-17 13:20:59 (GMT)
commit82244a4b24776202802f35797e0bb72ec32dd0e7 (patch)
tree7dd1475fc4ab49e6dfd6886cf75420850384bc0c
parentd242d2f863936a4e3e2b07a4d84b7f0c4b4eb817 (diff)
downloadQt-82244a4b24776202802f35797e0bb72ec32dd0e7.zip
Qt-82244a4b24776202802f35797e0bb72ec32dd0e7.tar.gz
Qt-82244a4b24776202802f35797e0bb72ec32dd0e7.tar.bz2
Fixed buffer overrun in Symbian QAudioInput backend
Task-number: QTBUG-13058 Reviewed-by: Derick Hawcroft
-rw-r--r--src/multimedia/audio/qaudioinput_symbian_p.cpp10
1 files changed, 6 insertions, 4 deletions
diff --git a/src/multimedia/audio/qaudioinput_symbian_p.cpp b/src/multimedia/audio/qaudioinput_symbian_p.cpp
index 9d240ca..9ae4368 100644
--- a/src/multimedia/audio/qaudioinput_symbian_p.cpp
+++ b/src/multimedia/audio/qaudioinput_symbian_p.cpp
@@ -373,7 +373,8 @@ qint64 QAudioInputPrivate::read(char *data, qint64 len)
TDesC8 &inputBuffer = buffer->Data();
- const qint64 inputBytes = bytesReady();
+ Q_ASSERT(inputBuffer.Length() >= m_devSoundBufferPos);
+ const qint64 inputBytes = inputBuffer.Length() - m_devSoundBufferPos;
const qint64 outputBytes = len - bytesRead;
const qint64 copyBytes = outputBytes < inputBytes ?
outputBytes : inputBytes;
@@ -384,7 +385,7 @@ qint64 QAudioInputPrivate::read(char *data, qint64 len)
data += copyBytes;
bytesRead += copyBytes;
- if (!bytesReady())
+ if (inputBytes == copyBytes)
bufferEmptied();
}
@@ -403,13 +404,14 @@ void QAudioInputPrivate::pullData()
TDesC8 &inputBuffer = buffer->Data();
- const qint64 inputBytes = bytesReady();
+ Q_ASSERT(inputBuffer.Length() >= m_devSoundBufferPos);
+ const qint64 inputBytes = inputBuffer.Length() - m_devSoundBufferPos;
const qint64 bytesPushed = m_sink->write(
(char*)inputBuffer.Ptr() + m_devSoundBufferPos, inputBytes);
m_devSoundBufferPos += bytesPushed;
- if (!bytesReady())
+ if (inputBytes == bytesPushed)
bufferEmptied();
if (!bytesPushed)