提交: 834fa293bf296c85169338c498cdc0bbf9891e2b - frameworks-av (git)

frameworks/av

Commit MetaInfo

• 修訂: 834fa293bf296c85169338c498cdc0bbf9891e2b (tree)
• 時間: 2019-10-24 13:07:30
• 作者: Chih-Wei Huang <cwhuang@linu...>
• Commiter: Chih-Wei Huang

Log Message

Android 8.1.0 Release 69 (5794017)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXZfQawAKCRDorT+BmrEO
eByZAJ40ShdvBhsIg/E2eo7t1VWuYjaOMACfVbkJCnQUx7u68pDsl6TiTpgQNYE=
=UuTD
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r69' into oreo-x86

Android 8.1.0 Release 69 (5794017)

Change Summary

• modified: media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
• delete: media/libstagefright/AVIExtractor.cpp
• modified: media/libstagefright/codecs/amrwbenc/Android.bp
• modified: media/libstagefright/codecs/amrwbenc/SampleCode/Android.bp
• modified: media/libstagefright/codecs/amrwbenc/src/c4t64fx.c
• modified: media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
• modified: media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
• modified: media/libstagefright/httplive/HTTPDownloader.cpp
• modified: media/libstagefright/omx/1.0/WGraphicBufferProducer.cpp
• modified: media/libstagefright/timedtext/TextDescriptions.cpp
• modified: services/audioflinger/AudioFlinger.cpp
• modified: services/audiopolicy/common/managerdefinitions/include/AudioInputDescriptor.h
• modified: services/audiopolicy/common/managerdefinitions/include/AudioOutputDescriptor.h
• modified: services/audiopolicy/common/managerdefinitions/include/AudioPolicyMix.h
• modified: services/audiopolicy/common/managerdefinitions/include/AudioSession.h
• modified: services/audiopolicy/common/managerdefinitions/src/AudioInputDescriptor.cpp
• modified: services/audiopolicy/common/managerdefinitions/src/AudioOutputDescriptor.cpp
• modified: services/audiopolicy/common/managerdefinitions/src/AudioPolicyMix.cpp
• modified: services/audiopolicy/common/managerdefinitions/src/AudioSession.cpp
• modified: services/audiopolicy/managerdefault/AudioPolicyManager.cpp
• modified: services/audiopolicy/managerdefault/AudioPolicyManager.h

差異

--- a/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
@@ -314,6 +314,11 @@ bool NuPlayer::CCDecoder::extractFromMPEGUserData(const sp<ABuffer> &accessUnit)
     const size_t *userData = (size_t *)mpegUserData->data();
 
     for (size_t i = 0; i < mpegUserData->size() / sizeof(size_t); ++i) {
+        if (accessUnit->size() < userData[i]) {
+            ALOGW("b/129068792, skip invalid offset for user data");
+            android_errorWriteLog(0x534e4554, "129068792");
+            continue;
+        }
         trackAdded |= parseMPEGUserDataUnit(
                 timeUs, accessUnit->data() + userData[i], accessUnit->size() - userData[i]);
     }
@@ -323,6 +328,12 @@ bool NuPlayer::CCDecoder::extractFromMPEGUserData(const sp<ABuffer> &accessUnit)
 
 // returns true if a new CC track is found
 bool NuPlayer::CCDecoder::parseMPEGUserDataUnit(int64_t timeUs, const uint8_t *data, size_t size) {
+    if (size < 9) {
+        ALOGW("b/129068792, MPEG user data size too small %zu", size);
+        android_errorWriteLog(0x534e4554, "129068792");
+        return false;
+    }
+
     ABitReader br(data + 4, 5);
 
     uint32_t user_identifier = br.getBits(32);
@@ -375,8 +386,14 @@ bool NuPlayer::CCDecoder::parseMPEGCCData(int64_t timeUs, const uint8_t *data, s
                 mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
                 br.skipBits(16);
             } else if (mDTVCCPacket->size() > 0 && cc_type == 2) {
-                memcpy(mDTVCCPacket->data() + mDTVCCPacket->size(), br.data(), 2);
-                mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
+                if (mDTVCCPacket->capacity() - mDTVCCPacket->size() >= 2) {
+                    memcpy(mDTVCCPacket->data() + mDTVCCPacket->size(), br.data(), 2);
+                    mDTVCCPacket->setRange(0, mDTVCCPacket->size() + 2);
+                } else {
+                    ALOGW("b/129068792, skip CC due to too much data(%zu, %zu)",
+                          mDTVCCPacket->capacity(), mDTVCCPacket->size());
+                    android_errorWriteLog(0x534e4554, "129068792");
+                }
                 br.skipBits(16);
             } else if (cc_type == 0 || cc_type == 1) {
                 uint8_t cc_data_1 = br.getBits(8) & 0x7f;
@@ -463,6 +480,11 @@ bool NuPlayer::CCDecoder::parseDTVCCPacket(int64_t timeUs, const uint8_t *data,
             size_t trackIndex = getTrackIndex(kTrackTypeCEA708, service_number, &trackAdded);
             if (mSelectedTrack == (ssize_t)trackIndex) {
                 sp<ABuffer> ccPacket = new ABuffer(block_size);
+                if (ccPacket->capacity() == 0) {
+                    ALOGW("b/129068792, no memory available, %zu", block_size);
+                    android_errorWriteLog(0x534e4554, "129068792");
+                    return false;
+                }
                 memcpy(ccPacket->data(), br.data(), block_size);
                 mCCMap.add(timeUs, ccPacket);
             }

--- a/media/libstagefright/AVIExtractor.cpp
+++ /dev/null
@@ -1,1307 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-//#define LOG_NDEBUG 0
-#define LOG_TAG "AVIExtractor"
-#include <utils/Log.h>
-
-#include "include/avc_utils.h"
-#include "include/AVIExtractor.h"
-
-#include <binder/ProcessState.h>
-#include <media/stagefright/foundation/hexdump.h>
-#include <media/stagefright/foundation/ABuffer.h>
-#include <media/stagefright/foundation/ADebug.h>
-#include <media/stagefright/DataSource.h>
-#include <media/stagefright/MediaBuffer.h>
-#include <media/stagefright/MediaBufferGroup.h>
-#include <media/stagefright/MediaDefs.h>
-#include <media/stagefright/MediaErrors.h>
-#include <media/stagefright/MetaData.h>
-#include <media/stagefright/Utils.h>
-
-namespace android {
-
-struct AVIExtractor::AVISource : public MediaSource {
-    AVISource(const sp<AVIExtractor> &extractor, size_t trackIndex);
-
-    virtual status_t start(MetaData *params);
-    virtual status_t stop();
-
-    virtual sp<MetaData> getFormat();
-
-    virtual status_t read(
-            MediaBuffer **buffer, const ReadOptions *options);
-
-protected:
-    virtual ~AVISource();
-
-private:
-    sp<AVIExtractor> mExtractor;
-    size_t mTrackIndex;
-    const AVIExtractor::Track &mTrack;
-    MediaBufferGroup *mBufferGroup;
-    size_t mSampleIndex;
-
-    sp<MP3Splitter> mSplitter;
-
-    DISALLOW_EVIL_CONSTRUCTORS(AVISource);
-};
-
-////////////////////////////////////////////////////////////////////////////////
-
-struct AVIExtractor::MP3Splitter : public RefBase {
-    MP3Splitter();
-
-    void clear();
-    void append(MediaBuffer *buffer);
-    status_t read(MediaBuffer **buffer);
-
-protected:
-    virtual ~MP3Splitter();
-
-private:
-    bool mFindSync;
-    int64_t mBaseTimeUs;
-    int64_t mNumSamplesRead;
-    sp<ABuffer> mBuffer;
-
-    bool resync();
-
-    DISALLOW_EVIL_CONSTRUCTORS(MP3Splitter);
-};
-
-////////////////////////////////////////////////////////////////////////////////
-
-AVIExtractor::AVISource::AVISource(
-        const sp<AVIExtractor> &extractor, size_t trackIndex)
-    : mExtractor(extractor),
-      mTrackIndex(trackIndex),
-      mTrack(mExtractor->mTracks.itemAt(trackIndex)),
-      mBufferGroup(NULL) {
-}
-
-AVIExtractor::AVISource::~AVISource() {
-    if (mBufferGroup) {
-        stop();
-    }
-}
-
-status_t AVIExtractor::AVISource::start(MetaData *params) {
-    CHECK(!mBufferGroup);
-
-    mBufferGroup = new MediaBufferGroup;
-
-    mBufferGroup->add_buffer(new MediaBuffer(mTrack.mMaxSampleSize));
-    mBufferGroup->add_buffer(new MediaBuffer(mTrack.mMaxSampleSize));
-    mSampleIndex = 0;
-
-    const char *mime;
-    CHECK(mTrack.mMeta->findCString(kKeyMIMEType, &mime));
-
-    if (!strcasecmp(mime, MEDIA_MIMETYPE_AUDIO_MPEG)) {
-        mSplitter = new MP3Splitter;
-    } else {
-        mSplitter.clear();
-    }
-
-    return OK;
-}
-
-status_t AVIExtractor::AVISource::stop() {
-    CHECK(mBufferGroup);
-
-    delete mBufferGroup;
-    mBufferGroup = NULL;
-
-    mSplitter.clear();
-
-    return OK;
-}
-
-sp<MetaData> AVIExtractor::AVISource::getFormat() {
-    return mTrack.mMeta;
-}
-
-status_t AVIExtractor::AVISource::read(
-        MediaBuffer **buffer, const ReadOptions *options) {
-    CHECK(mBufferGroup);
-
-    *buffer = NULL;
-
-    int64_t seekTimeUs;
-    ReadOptions::SeekMode seekMode;
-    if (options && options->getSeekTo(&seekTimeUs, &seekMode)) {
-        status_t err =
-            mExtractor->getSampleIndexAtTime(
-                    mTrackIndex, seekTimeUs, seekMode, &mSampleIndex);
-
-        if (err != OK) {
-            return ERROR_END_OF_STREAM;
-        }
-
-        if (mSplitter != NULL) {
-            mSplitter->clear();
-        }
-    }
-
-    for (;;) {
-        if (mSplitter != NULL) {
-            status_t err = mSplitter->read(buffer);
-
-            if (err == OK) {
-                break;
-            } else if (err != -EAGAIN) {
-                return err;
-            }
-        }
-
-        off64_t offset;
-        size_t size;
-        bool isKey;
-        int64_t timeUs;
-        status_t err = mExtractor->getSampleInfo(
-                mTrackIndex, mSampleIndex, &offset, &size, &isKey, &timeUs);
-
-        ++mSampleIndex;
-
-        if (err != OK) {
-            return ERROR_END_OF_STREAM;
-        }
-
-        MediaBuffer *out;
-        CHECK_EQ(mBufferGroup->acquire_buffer(&out), (status_t)OK);
-
-        ssize_t n = mExtractor->mDataSource->readAt(offset, out->data(), size);
-
-        if (n < (ssize_t)size) {
-            return n < 0 ? (status_t)n : (status_t)ERROR_MALFORMED;
-        }
-
-        out->set_range(0, size);
-
-        out->meta_data()->setInt64(kKeyTime, timeUs);
-
-        if (isKey) {
-            out->meta_data()->setInt32(kKeyIsSyncFrame, 1);
-        }
-
-        if (mSplitter == NULL) {
-            *buffer = out;
-            break;
-        }
-
-        mSplitter->append(out);
-        out->release();
-        out = NULL;
-    }
-
-    return OK;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-
-AVIExtractor::MP3Splitter::MP3Splitter()
-    : mFindSync(true),
-      mBaseTimeUs(-1ll),
-      mNumSamplesRead(0) {
-}
-
-AVIExtractor::MP3Splitter::~MP3Splitter() {
-}
-
-void AVIExtractor::MP3Splitter::clear() {
-    mFindSync = true;
-    mBaseTimeUs = -1ll;
-    mNumSamplesRead = 0;
-
-    if (mBuffer != NULL) {
-        mBuffer->setRange(0, 0);
-    }
-}
-
-void AVIExtractor::MP3Splitter::append(MediaBuffer *buffer) {
-    size_t prevCapacity = (mBuffer != NULL) ? mBuffer->capacity() : 0;
-
-    if (mBaseTimeUs < 0) {
-        CHECK(mBuffer == NULL || mBuffer->size() == 0);
-        CHECK(buffer->meta_data()->findInt64(kKeyTime, &mBaseTimeUs));
-        mNumSamplesRead = 0;
-    }
-
-    if (mBuffer != NULL && mBuffer->offset() > 0) {
-        memmove(mBuffer->base(), mBuffer->data(), mBuffer->size());
-        mBuffer->setRange(0, mBuffer->size());
-    }
-
-    if (mBuffer == NULL
-            || mBuffer->size() + buffer->range_length() > prevCapacity) {
-        size_t newCapacity =
-            (prevCapacity + buffer->range_length() + 1023) & ~1023;
-
-        sp<ABuffer> newBuffer = new ABuffer(newCapacity);
-        if (mBuffer != NULL) {
-            memcpy(newBuffer->data(), mBuffer->data(), mBuffer->size());
-            newBuffer->setRange(0, mBuffer->size());
-        } else {
-            newBuffer->setRange(0, 0);
-        }
-        mBuffer = newBuffer;
-    }
-
-    memcpy(mBuffer->data() + mBuffer->size(),
-           (const uint8_t *)buffer->data() + buffer->range_offset(),
-           buffer->range_length());
-
-    mBuffer->setRange(0, mBuffer->size() + buffer->range_length());
-}
-
-bool AVIExtractor::MP3Splitter::resync() {
-    if (mBuffer == NULL) {
-        return false;
-    }
-
-    bool foundSync = false;
-    for (size_t offset = 0; offset + 3 < mBuffer->size(); ++offset) {
-        uint32_t firstHeader = U32_AT(mBuffer->data() + offset);
-
-        size_t frameSize;
-        if (!GetMPEGAudioFrameSize(firstHeader, &frameSize)) {
-            continue;
-        }
-
-        size_t subsequentOffset = offset + frameSize;
-        size_t i = 3;
-        while (i > 0) {
-            if (subsequentOffset + 3 >= mBuffer->size()) {
-                break;
-            }
-
-            static const uint32_t kMask = 0xfffe0c00;
-
-            uint32_t header = U32_AT(mBuffer->data() + subsequentOffset);
-            if ((header & kMask) != (firstHeader & kMask)) {
-                break;
-            }
-
-            if (!GetMPEGAudioFrameSize(header, &frameSize)) {
-                break;
-            }
-
-            subsequentOffset += frameSize;
-            --i;
-        }
-
-        if (i == 0) {
-            foundSync = true;
-            memmove(mBuffer->data(),
-                    mBuffer->data() + offset,
-                    mBuffer->size() - offset);
-
-            mBuffer->setRange(0, mBuffer->size() - offset);
-            break;
-        }
-    }
-
-    return foundSync;
-}
-
-status_t AVIExtractor::MP3Splitter::read(MediaBuffer **out) {
-    *out = NULL;
-
-    if (mFindSync) {
-        if (!resync()) {
-            return -EAGAIN;
-        }
-
-        mFindSync = false;
-    }
-
-    if (mBuffer->size() < 4) {
-        return -EAGAIN;
-    }
-
-    uint32_t header = U32_AT(mBuffer->data());
-    size_t frameSize;
-    int sampleRate;
-    int numSamples;
-    if (!GetMPEGAudioFrameSize(
-                header, &frameSize, &sampleRate, NULL, NULL, &numSamples)) {
-        return ERROR_MALFORMED;
-    }
-
-    if (mBuffer->size() < frameSize) {
-        return -EAGAIN;
-    }
-
-    MediaBuffer *mbuf = new MediaBuffer(frameSize);
-    memcpy(mbuf->data(), mBuffer->data(), frameSize);
-
-    int64_t timeUs = mBaseTimeUs + (mNumSamplesRead * 1000000ll) / sampleRate;
-    mNumSamplesRead += numSamples;
-
-    mbuf->meta_data()->setInt64(kKeyTime, timeUs);
-
-    mBuffer->setRange(
-            mBuffer->offset() + frameSize, mBuffer->size() - frameSize);
-
-    *out = mbuf;
-
-    return OK;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-
-AVIExtractor::AVIExtractor(const sp<DataSource> &dataSource)
-    : mDataSource(dataSource) {
-    mInitCheck = parseHeaders();
-
-    if (mInitCheck != OK) {
-        mTracks.clear();
-    }
-}
-
-AVIExtractor::~AVIExtractor() {
-}
-
-size_t AVIExtractor::countTracks() {
-    return mTracks.size();
-}
-
-sp<MediaSource> AVIExtractor::getTrack(size_t index) {
-    return index < mTracks.size() ? new AVISource(this, index) : NULL;
-}
-
-sp<MetaData> AVIExtractor::getTrackMetaData(
-        size_t index, uint32_t flags) {
-    return index < mTracks.size() ? mTracks.editItemAt(index).mMeta : NULL;
-}
-
-sp<MetaData> AVIExtractor::getMetaData() {
-    sp<MetaData> meta = new MetaData;
-
-    if (mInitCheck == OK) {
-        meta->setCString(kKeyMIMEType, MEDIA_MIMETYPE_CONTAINER_AVI);
-    }
-
-    return meta;
-}
-
-status_t AVIExtractor::parseHeaders() {
-    mTracks.clear();
-    mMovieOffset = 0;
-    mFoundIndex = false;
-    mOffsetsAreAbsolute = false;
-
-    ssize_t res = parseChunk(0ll, -1ll);
-
-    if (res < 0) {
-        return (status_t)res;
-    }
-
-    if (mMovieOffset == 0ll || !mFoundIndex) {
-        return ERROR_MALFORMED;
-    }
-
-    return OK;
-}
-
-ssize_t AVIExtractor::parseChunk(off64_t offset, off64_t size, int depth) {
-    if (size >= 0 && size < 8) {
-        return ERROR_MALFORMED;
-    }
-
-    uint8_t tmp[12];
-    ssize_t n = mDataSource->readAt(offset, tmp, 8);
-
-    if (n < 8) {
-        return (n < 0) ? n : (ssize_t)ERROR_MALFORMED;
-    }
-
-    uint32_t fourcc = U32_AT(tmp);
-    uint32_t chunkSize = U32LE_AT(&tmp[4]);
-
-    if (size >= 0 && chunkSize + 8 > size) {
-        return ERROR_MALFORMED;
-    }
-
-    static const char kPrefix[] = "                              ";
-    const char *prefix = &kPrefix[strlen(kPrefix) - 2 * depth];
-
-    if (fourcc == FOURCC('L', 'I', 'S', 'T')
-            || fourcc == FOURCC('R', 'I', 'F', 'F')) {
-        // It's a list of chunks
-
-        if (size >= 0 && size < 12) {
-            return ERROR_MALFORMED;
-        }
-
-        n = mDataSource->readAt(offset + 8, &tmp[8], 4);
-
-        if (n < 4) {
-            return (n < 0) ? n : (ssize_t)ERROR_MALFORMED;
-        }
-
-        uint32_t subFourcc = U32_AT(&tmp[8]);
-
-        ALOGV("%s offset 0x%08llx LIST of '%c%c%c%c', size %d",
-             prefix,
-             offset,
-             (char)(subFourcc >> 24),
-             (char)((subFourcc >> 16) & 0xff),
-             (char)((subFourcc >> 8) & 0xff),
-             (char)(subFourcc & 0xff),
-             chunkSize - 4);
-
-        if (subFourcc == FOURCC('m', 'o', 'v', 'i')) {
-            // We're not going to parse this, but will take note of the
-            // offset.
-
-            mMovieOffset = offset;
-        } else {
-            off64_t subOffset = offset + 12;
-            off64_t subOffsetLimit = subOffset + chunkSize - 4;
-            while (subOffset < subOffsetLimit) {
-                ssize_t res =
-                    parseChunk(subOffset, subOffsetLimit - subOffset, depth + 1);
-
-                if (res < 0) {
-                    return res;
-                }
-
-                subOffset += res;
-            }
-        }
-    } else {
-        ALOGV("%s offset 0x%08llx CHUNK '%c%c%c%c'",
-             prefix,
-             offset,
-             (char)(fourcc >> 24),
-             (char)((fourcc >> 16) & 0xff),
-             (char)((fourcc >> 8) & 0xff),
-             (char)(fourcc & 0xff));
-
-        status_t err = OK;
-
-        switch (fourcc) {
-            case FOURCC('s', 't', 'r', 'h'):
-            {
-                err = parseStreamHeader(offset + 8, chunkSize);
-                break;
-            }
-
-            case FOURCC('s', 't', 'r', 'f'):
-            {
-                err = parseStreamFormat(offset + 8, chunkSize);
-                break;
-            }
-
-            case FOURCC('i', 'd', 'x', '1'):
-            {
-                err = parseIndex(offset + 8, chunkSize);
-                break;
-            }
-
-            default:
-                break;
-        }
-
-        if (err != OK) {
-            return err;
-        }
-    }
-
-    if (chunkSize & 1) {
-        ++chunkSize;
-    }
-
-    return chunkSize + 8;
-}
-
-static const char *GetMIMETypeForHandler(uint32_t handler) {
-    switch (handler) {
-        // Wow... shamelessly copied from
-        // http://wiki.multimedia.cx/index.php?title=ISO_MPEG-4
-
-        case FOURCC('3', 'I', 'V', '2'):
-        case FOURCC('3', 'i', 'v', '2'):
-        case FOURCC('B', 'L', 'Z', '0'):
-        case FOURCC('D', 'I', 'G', 'I'):
-        case FOURCC('D', 'I', 'V', '1'):
-        case FOURCC('d', 'i', 'v', '1'):
-        case FOURCC('D', 'I', 'V', 'X'):
-        case FOURCC('d', 'i', 'v', 'x'):
-        case FOURCC('D', 'X', '5', '0'):
-        case FOURCC('d', 'x', '5', '0'):
-        case FOURCC('D', 'X', 'G', 'M'):
-        case FOURCC('E', 'M', '4', 'A'):
-        case FOURCC('E', 'P', 'H', 'V'):
-        case FOURCC('F', 'M', 'P', '4'):
-        case FOURCC('f', 'm', 'p', '4'):
-        case FOURCC('F', 'V', 'F', 'W'):
-        case FOURCC('H', 'D', 'X', '4'):
-        case FOURCC('h', 'd', 'x', '4'):
-        case FOURCC('M', '4', 'C', 'C'):
-        case FOURCC('M', '4', 'S', '2'):
-        case FOURCC('m', '4', 's', '2'):
-        case FOURCC('M', 'P', '4', 'S'):
-        case FOURCC('m', 'p', '4', 's'):
-        case FOURCC('M', 'P', '4', 'V'):
-        case FOURCC('m', 'p', '4', 'v'):
-        case FOURCC('M', 'V', 'X', 'M'):
-        case FOURCC('R', 'M', 'P', '4'):
-        case FOURCC('S', 'E', 'D', 'G'):
-        case FOURCC('S', 'M', 'P', '4'):
-        case FOURCC('U', 'M', 'P', '4'):
-        case FOURCC('W', 'V', '1', 'F'):
-        case FOURCC('X', 'V', 'I', 'D'):
-        case FOURCC('X', 'v', 'i', 'D'):
-        case FOURCC('x', 'v', 'i', 'd'):
-        case FOURCC('X', 'V', 'I', 'X'):
-            return MEDIA_MIMETYPE_VIDEO_MPEG4;
-
-        // from http://wiki.multimedia.cx/index.php?title=H264
-        case FOURCC('a', 'v', 'c', '1'):
-        case FOURCC('d', 'a', 'v', 'c'):
-        case FOURCC('x', '2', '6', '4'):
-        case FOURCC('H', '2', '6', '4'):
-        case FOURCC('v', 's', 's', 'h'):
-            return MEDIA_MIMETYPE_VIDEO_AVC;
-
-        default:
-            return NULL;
-    }
-}
-
-status_t AVIExtractor::parseStreamHeader(off64_t offset, size_t size) {
-    if (size != 56) {
-        return ERROR_MALFORMED;
-    }
-
-    if (mTracks.size() > 99) {
-        return -ERANGE;
-    }
-
-    sp<ABuffer> buffer = new ABuffer(size);
-    ssize_t n = mDataSource->readAt(offset, buffer->data(), buffer->size());
-
-    if (n < (ssize_t)size) {
-        return n < 0 ? (status_t)n : ERROR_MALFORMED;
-    }
-
-    const uint8_t *data = buffer->data();
-
-    uint32_t type = U32_AT(data);
-    uint32_t handler = U32_AT(&data[4]);
-    uint32_t flags = U32LE_AT(&data[8]);
-
-    sp<MetaData> meta = new MetaData;
-
-    uint32_t rate = U32LE_AT(&data[20]);
-    uint32_t scale = U32LE_AT(&data[24]);
-
-    uint32_t sampleSize = U32LE_AT(&data[44]);
-
-    const char *mime = NULL;
-    Track::Kind kind = Track::OTHER;
-
-    if (type == FOURCC('v', 'i', 'd', 's')) {
-        mime = GetMIMETypeForHandler(handler);
-
-        if (mime && strncasecmp(mime, "video/", 6)) {
-            return ERROR_MALFORMED;
-        }
-
-        if (mime == NULL) {
-            ALOGW("Unsupported video format '%c%c%c%c'",
-                 (char)(handler >> 24),
-                 (char)((handler >> 16) & 0xff),
-                 (char)((handler >> 8) & 0xff),
-                 (char)(handler & 0xff));
-        }
-
-        kind = Track::VIDEO;
-    } else if (type == FOURCC('a', 'u', 'd', 's')) {
-        if (mime && strncasecmp(mime, "audio/", 6)) {
-            return ERROR_MALFORMED;
-        }
-
-        kind = Track::AUDIO;
-    }
-
-    if (!mime) {
-        mime = "application/octet-stream";
-    }
-
-    meta->setCString(kKeyMIMEType, mime);
-
-    mTracks.push();
-    Track *track = &mTracks.editItemAt(mTracks.size() - 1);
-
-    track->mMeta = meta;
-    track->mRate = rate;
-    track->mScale = scale;
-    track->mBytesPerSample = sampleSize;
-    track->mKind = kind;
-    track->mNumSyncSamples = 0;
-    track->mThumbnailSampleSize = 0;
-    track->mThumbnailSampleIndex = -1;
-    track->mMaxSampleSize = 0;
-    track->mAvgChunkSize = 1.0;
-    track->mFirstChunkSize = 0;
-
-    return OK;
-}
-
-status_t AVIExtractor::parseStreamFormat(off64_t offset, size_t size) {
-    if (mTracks.isEmpty()) {
-        return ERROR_MALFORMED;
-    }
-
-    Track *track = &mTracks.editItemAt(mTracks.size() - 1);
-
-    if (track->mKind == Track::OTHER) {
-        // We don't support this content, but that's not a parsing error.
-        return OK;
-    }
-
-    bool isVideo = (track->mKind == Track::VIDEO);
-
-    if ((isVideo && size < 40) || (!isVideo && size < 16)) {
-        // Expected a BITMAPINFO or WAVEFORMAT(EX) structure, respectively.
-        return ERROR_MALFORMED;
-    }
-
-    sp<ABuffer> buffer = new ABuffer(size);
-    ssize_t n = mDataSource->readAt(offset, buffer->data(), buffer->size());
-
-    if (n < (ssize_t)size) {
-        return n < 0 ? (status_t)n : ERROR_MALFORMED;
-    }
-
-    const uint8_t *data = buffer->data();
-
-    if (isVideo) {
-        uint32_t width = U32LE_AT(&data[4]);
-        uint32_t height = U32LE_AT(&data[8]);
-
-        track->mMeta->setInt32(kKeyWidth, width);
-        track->mMeta->setInt32(kKeyHeight, height);
-    } else {
-        uint32_t format = U16LE_AT(data);
-
-        if (format == 0x55) {
-            track->mMeta->setCString(kKeyMIMEType, MEDIA_MIMETYPE_AUDIO_MPEG);
-        } else {
-            ALOGW("Unsupported audio format = 0x%04x", format);
-        }
-
-        uint32_t numChannels = U16LE_AT(&data[2]);
-        uint32_t sampleRate = U32LE_AT(&data[4]);
-
-        track->mMeta->setInt32(kKeyChannelCount, numChannels);
-        track->mMeta->setInt32(kKeySampleRate, sampleRate);
-    }
-
-    return OK;
-}
-
-// static
-bool AVIExtractor::IsCorrectChunkType(
-        ssize_t trackIndex, Track::Kind kind, uint32_t chunkType) {
-    uint32_t chunkBase = chunkType & 0xffff;
-
-    switch (kind) {
-        case Track::VIDEO:
-        {
-            if (chunkBase != FOURCC(0, 0, 'd', 'c')
-                    && chunkBase != FOURCC(0, 0, 'd', 'b')) {
-                return false;
-            }
-            break;
-        }
-
-        case Track::AUDIO:
-        {
-            if (chunkBase != FOURCC(0, 0, 'w', 'b')) {
-                return false;
-            }
-            break;
-        }
-
-        default:
-            break;
-    }
-
-    if (trackIndex < 0) {
-        return true;
-    }
-
-    uint8_t hi = chunkType >> 24;
-    uint8_t lo = (chunkType >> 16) & 0xff;
-
-    if (hi < '0' || hi > '9' || lo < '0' || lo > '9') {
-        return false;
-    }
-
-    if (trackIndex != (10 * (hi - '0') + (lo - '0'))) {
-        return false;
-    }
-
-    return true;
-}
-
-status_t AVIExtractor::parseIndex(off64_t offset, size_t size) {
-    if ((size % 16) != 0) {
-        return ERROR_MALFORMED;
-    }
-
-    sp<ABuffer> buffer = new ABuffer(size);
-    ssize_t n = mDataSource->readAt(offset, buffer->data(), buffer->size());
-
-    if (n < (ssize_t)size) {
-        return n < 0 ? (status_t)n : ERROR_MALFORMED;
-    }
-
-    const uint8_t *data = buffer->data();
-
-    while (size > 0) {
-        uint32_t chunkType = U32_AT(data);
-
-        uint8_t hi = chunkType >> 24;
-        uint8_t lo = (chunkType >> 16) & 0xff;
-
-        if (hi < '0' || hi > '9' || lo < '0' || lo > '9') {
-            return ERROR_MALFORMED;
-        }
-
-        size_t trackIndex = 10 * (hi - '0') + (lo - '0');
-
-        if (trackIndex >= mTracks.size()) {
-            return ERROR_MALFORMED;
-        }
-
-        Track *track = &mTracks.editItemAt(trackIndex);
-
-        if (!IsCorrectChunkType(-1, track->mKind, chunkType)) {
-            return ERROR_MALFORMED;
-        }
-
-        if (track->mKind == Track::OTHER) {
-            data += 16;
-            size -= 16;
-            continue;
-        }
-
-        uint32_t flags = U32LE_AT(&data[4]);
-        uint32_t offset = U32LE_AT(&data[8]);
-        uint32_t chunkSize = U32LE_AT(&data[12]);
-
-        if (chunkSize > track->mMaxSampleSize) {
-            track->mMaxSampleSize = chunkSize;
-        }
-
-        track->mSamples.push();
-
-        SampleInfo *info =
-            &track->mSamples.editItemAt(track->mSamples.size() - 1);
-
-        info->mOffset = offset;
-        info->mIsKey = (flags & 0x10) != 0;
-
-        if (info->mIsKey) {
-            static const size_t kMaxNumSyncSamplesToScan = 20;
-
-            if (track->mNumSyncSamples < kMaxNumSyncSamplesToScan) {
-                if (chunkSize > track->mThumbnailSampleSize) {
-                    track->mThumbnailSampleSize = chunkSize;
-
-                    track->mThumbnailSampleIndex =
-                        track->mSamples.size() - 1;
-                }
-            }
-
-            ++track->mNumSyncSamples;
-        }
-
-        data += 16;
-        size -= 16;
-    }
-
-    if (!mTracks.isEmpty()) {
-        off64_t offset;
-        size_t size;
-        bool isKey;
-        int64_t timeUs;
-        status_t err = getSampleInfo(0, 0, &offset, &size, &isKey, &timeUs);
-
-        if (err != OK) {
-            mOffsetsAreAbsolute = !mOffsetsAreAbsolute;
-            err = getSampleInfo(0, 0, &offset, &size, &isKey, &timeUs);
-
-            if (err != OK) {
-                return err;
-            }
-        }
-
-        ALOGV("Chunk offsets are %s",
-             mOffsetsAreAbsolute ? "absolute" : "movie-chunk relative");
-    }
-
-    for (size_t i = 0; i < mTracks.size(); ++i) {
-        Track *track = &mTracks.editItemAt(i);
-
-        if (track->mBytesPerSample > 0) {
-            // Assume all chunks are roughly the same size for now.
-
-            // Compute the avg. size of the first 128 chunks (if there are
-            // that many), but exclude the size of the first one, since
-            // it may be an outlier.
-            size_t numSamplesToAverage = track->mSamples.size();
-            if (numSamplesToAverage > 256) {
-                numSamplesToAverage = 256;
-            }
-
-            double avgChunkSize = 0;
-            size_t j;
-            for (j = 0; j <= numSamplesToAverage; ++j) {
-                off64_t offset;
-                size_t size;
-                bool isKey;
-                int64_t dummy;
-
-                status_t err =
-                    getSampleInfo(
-                            i, j,
-                            &offset, &size, &isKey, &dummy);
-
-                if (err != OK) {
-                    return err;
-                }
-
-                if (j == 0) {
-                    track->mFirstChunkSize = size;
-                    continue;
-                }
-
-                avgChunkSize += size;
-            }
-
-            avgChunkSize /= numSamplesToAverage;
-
-            track->mAvgChunkSize = avgChunkSize;
-        }
-
-        int64_t durationUs;
-        CHECK_EQ((status_t)OK,
-                 getSampleTime(i, track->mSamples.size() - 1, &durationUs));
-
-        ALOGV("track %d duration = %.2f secs", i, durationUs / 1E6);
-
-        track->mMeta->setInt64(kKeyDuration, durationUs);
-        track->mMeta->setInt32(kKeyMaxInputSize, track->mMaxSampleSize);
-
-        const char *tmp;
-        CHECK(track->mMeta->findCString(kKeyMIMEType, &tmp));
-
-        AString mime = tmp;
-
-        if (!strncasecmp("video/", mime.c_str(), 6)) {
-            if (track->mThumbnailSampleIndex >= 0) {
-                int64_t thumbnailTimeUs;
-                CHECK_EQ((status_t)OK,
-                         getSampleTime(i, track->mThumbnailSampleIndex,
-                                       &thumbnailTimeUs));
-
-                track->mMeta->setInt64(kKeyThumbnailTime, thumbnailTimeUs);
-            }
-
-            status_t err = OK;
-
-            if (!strcasecmp(mime.c_str(), MEDIA_MIMETYPE_VIDEO_MPEG4)) {
-                err = addMPEG4CodecSpecificData(i);
-            } else if (!strcasecmp(mime.c_str(), MEDIA_MIMETYPE_VIDEO_AVC)) {
-                err = addH264CodecSpecificData(i);
-            }
-
-            if (err != OK) {
-                return err;
-            }
-        }
-    }
-
-    mFoundIndex = true;
-
-    return OK;
-}
-
-static size_t GetSizeWidth(size_t x) {
-    size_t n = 1;
-    while (x > 127) {
-        ++n;
-        x >>= 7;
-    }
-    return n;
-}
-
-static uint8_t *EncodeSize(uint8_t *dst, size_t x) {
-    while (x > 127) {
-        *dst++ = (x & 0x7f) | 0x80;
-        x >>= 7;
-    }
-    *dst++ = x;
-    return dst;
-}
-
-sp<ABuffer> MakeMPEG4VideoCodecSpecificData(const sp<ABuffer> &config) {
-    size_t len1 = config->size() + GetSizeWidth(config->size()) + 1;
-    size_t len2 = len1 + GetSizeWidth(len1) + 1 + 13;
-    size_t len3 = len2 + GetSizeWidth(len2) + 1 + 3;
-
-    sp<ABuffer> csd = new ABuffer(len3);
-    uint8_t *dst = csd->data();
-    *dst++ = 0x03;
-    dst = EncodeSize(dst, len2 + 3);
-    *dst++ = 0x00;  // ES_ID
-    *dst++ = 0x00;
-    *dst++ = 0x00;  // streamDependenceFlag, URL_Flag, OCRstreamFlag
-
-    *dst++ = 0x04;
-    dst = EncodeSize(dst, len1 + 13);
-    *dst++ = 0x01;  // Video ISO/IEC 14496-2 Simple Profile
-    for (size_t i = 0; i < 12; ++i) {
-        *dst++ = 0x00;
-    }
-
-    *dst++ = 0x05;
-    dst = EncodeSize(dst, config->size());
-    memcpy(dst, config->data(), config->size());
-    dst += config->size();
-
-    // hexdump(csd->data(), csd->size());
-
-    return csd;
-}
-
-status_t AVIExtractor::addMPEG4CodecSpecificData(size_t trackIndex) {
-    Track *track = &mTracks.editItemAt(trackIndex);
-
-    off64_t offset;
-    size_t size;
-    bool isKey;
-    int64_t timeUs;
-    status_t err =
-        getSampleInfo(trackIndex, 0, &offset, &size, &isKey, &timeUs);
-
-    if (err != OK) {
-        return err;
-    }
-
-    sp<ABuffer> buffer = new ABuffer(size);
-    ssize_t n = mDataSource->readAt(offset, buffer->data(), buffer->size());
-
-    if (n < (ssize_t)size) {
-        return n < 0 ? (status_t)n : ERROR_MALFORMED;
-    }
-
-    // Extract everything up to the first VOP start code from the first
-    // frame's encoded data and use it to construct an ESDS with the
-    // codec specific data.
-
-    size_t i = 0;
-    bool found = false;
-    while (i + 3 < buffer->size()) {
-        if (!memcmp("\x00\x00\x01\xb6", &buffer->data()[i], 4)) {
-            found = true;
-            break;
-        }
-
-        ++i;
-    }
-
-    if (!found) {
-        return ERROR_MALFORMED;
-    }
-
-    buffer->setRange(0, i);
-
-    sp<ABuffer> csd = MakeMPEG4VideoCodecSpecificData(buffer);
-    track->mMeta->setData(kKeyESDS, kTypeESDS, csd->data(), csd->size());
-
-    return OK;
-}
-
-status_t AVIExtractor::addH264CodecSpecificData(size_t trackIndex) {
-    Track *track = &mTracks.editItemAt(trackIndex);
-
-    off64_t offset;
-    size_t size;
-    bool isKey;
-    int64_t timeUs;
-
-    // Extract codec specific data from the first non-empty sample.
-
-    size_t sampleIndex = 0;
-    for (;;) {
-        status_t err =
-            getSampleInfo(
-                    trackIndex, sampleIndex, &offset, &size, &isKey, &timeUs);
-
-        if (err != OK) {
-            return err;
-        }
-
-        if (size > 0) {
-            break;
-        }
-
-        ++sampleIndex;
-    }
-
-    sp<ABuffer> buffer = new ABuffer(size);
-    ssize_t n = mDataSource->readAt(offset, buffer->data(), buffer->size());
-
-    if (n < (ssize_t)size) {
-        return n < 0 ? (status_t)n : ERROR_MALFORMED;
-    }
-
-    sp<MetaData> meta = MakeAVCCodecSpecificData(buffer);
-
-    if (meta == NULL) {
-        ALOGE("Unable to extract AVC codec specific data");
-        return ERROR_MALFORMED;
-    }
-
-    int32_t width, height;
-    CHECK(meta->findInt32(kKeyWidth, &width));
-    CHECK(meta->findInt32(kKeyHeight, &height));
-
-    uint32_t type;
-    const void *csd;
-    size_t csdSize;
-    CHECK(meta->findData(kKeyAVCC, &type, &csd, &csdSize));
-
-    track->mMeta->setInt32(kKeyWidth, width);
-    track->mMeta->setInt32(kKeyHeight, height);
-    track->mMeta->setData(kKeyAVCC, type, csd, csdSize);
-
-    return OK;
-}
-
-status_t AVIExtractor::getSampleInfo(
-        size_t trackIndex, size_t sampleIndex,
-        off64_t *offset, size_t *size, bool *isKey,
-        int64_t *sampleTimeUs) {
-    if (trackIndex >= mTracks.size()) {
-        return -ERANGE;
-    }
-
-    const Track &track = mTracks.itemAt(trackIndex);
-
-    if (sampleIndex >= track.mSamples.size()) {
-        return -ERANGE;
-    }
-
-    const SampleInfo &info = track.mSamples.itemAt(sampleIndex);
-
-    if (!mOffsetsAreAbsolute) {
-        *offset = info.mOffset + mMovieOffset + 8;
-    } else {
-        *offset = info.mOffset;
-    }
-
-    *size = 0;
-
-    uint8_t tmp[8];
-    ssize_t n = mDataSource->readAt(*offset, tmp, 8);
-
-    if (n < 8) {
-        return n < 0 ? (status_t)n : (status_t)ERROR_MALFORMED;
-    }
-
-    uint32_t chunkType = U32_AT(tmp);
-
-    if (!IsCorrectChunkType(trackIndex, track.mKind, chunkType)) {
-        return ERROR_MALFORMED;
-    }
-
-    *offset += 8;
-    *size = U32LE_AT(&tmp[4]);
-
-    *isKey = info.mIsKey;
-
-    if (track.mBytesPerSample > 0) {
-        size_t sampleStartInBytes;
-        if (sampleIndex == 0) {
-            sampleStartInBytes = 0;
-        } else {
-            sampleStartInBytes =
-                track.mFirstChunkSize + track.mAvgChunkSize * (sampleIndex - 1);
-        }
-
-        sampleIndex = sampleStartInBytes / track.mBytesPerSample;
-    }
-
-    *sampleTimeUs = (sampleIndex * 1000000ll * track.mRate) / track.mScale;
-
-    return OK;
-}
-
-status_t AVIExtractor::getSampleTime(
-        size_t trackIndex, size_t sampleIndex, int64_t *sampleTimeUs) {
-    off64_t offset;
-    size_t size;
-    bool isKey;
-    return getSampleInfo(
-            trackIndex, sampleIndex, &offset, &size, &isKey, sampleTimeUs);
-}
-
-status_t AVIExtractor::getSampleIndexAtTime(
-        size_t trackIndex,
-        int64_t timeUs, MediaSource::ReadOptions::SeekMode mode,
-        size_t *sampleIndex) const {
-    if (trackIndex >= mTracks.size()) {
-        return -ERANGE;
-    }
-
-    const Track &track = mTracks.itemAt(trackIndex);
-
-    ssize_t closestSampleIndex;
-
-    if (track.mBytesPerSample > 0) {
-        size_t closestByteOffset =
-            (timeUs * track.mBytesPerSample)
-                / track.mRate * track.mScale / 1000000ll;
-
-        if (closestByteOffset <= track.mFirstChunkSize) {
-            closestSampleIndex = 0;
-        } else {
-            closestSampleIndex =
-                (closestByteOffset - track.mFirstChunkSize)
-                    / track.mAvgChunkSize;
-        }
-    } else {
-        // Each chunk contains a single sample.
-        closestSampleIndex = timeUs / track.mRate * track.mScale / 1000000ll;
-    }
-
-    ssize_t numSamples = track.mSamples.size();
-
-    if (closestSampleIndex < 0) {
-        closestSampleIndex = 0;
-    } else if (closestSampleIndex >= numSamples) {
-        closestSampleIndex = numSamples - 1;
-    }
-
-    if (mode == MediaSource::ReadOptions::SEEK_CLOSEST) {
-        *sampleIndex = closestSampleIndex;
-
-        return OK;
-    }
-
-    ssize_t prevSyncSampleIndex = closestSampleIndex;
-    while (prevSyncSampleIndex >= 0) {
-        const SampleInfo &info =
-            track.mSamples.itemAt(prevSyncSampleIndex);
-
-        if (info.mIsKey) {
-            break;
-        }
-
-        --prevSyncSampleIndex;
-    }
-
-    ssize_t nextSyncSampleIndex = closestSampleIndex;
-    while (nextSyncSampleIndex < numSamples) {
-        const SampleInfo &info =
-            track.mSamples.itemAt(nextSyncSampleIndex);
-
-        if (info.mIsKey) {
-            break;
-        }
-
-        ++nextSyncSampleIndex;
-    }
-
-    switch (mode) {
-        case MediaSource::ReadOptions::SEEK_PREVIOUS_SYNC:
-        {
-            *sampleIndex = prevSyncSampleIndex;
-
-            return prevSyncSampleIndex >= 0 ? OK : UNKNOWN_ERROR;
-        }
-
-        case MediaSource::ReadOptions::SEEK_NEXT_SYNC:
-        {
-            *sampleIndex = nextSyncSampleIndex;
-
-            return nextSyncSampleIndex < numSamples ? OK : UNKNOWN_ERROR;
-        }
-
-        case MediaSource::ReadOptions::SEEK_CLOSEST_SYNC:
-        {
-            if (prevSyncSampleIndex < 0 && nextSyncSampleIndex >= numSamples) {
-                return UNKNOWN_ERROR;
-            }
-
-            if (prevSyncSampleIndex < 0) {
-                *sampleIndex = nextSyncSampleIndex;
-                return OK;
-            }
-
-            if (nextSyncSampleIndex >= numSamples) {
-                *sampleIndex = prevSyncSampleIndex;
-                return OK;
-            }
-
-            size_t dist1 = closestSampleIndex - prevSyncSampleIndex;
-            size_t dist2 = nextSyncSampleIndex - closestSampleIndex;
-
-            *sampleIndex =
-                (dist1 < dist2) ? prevSyncSampleIndex : nextSyncSampleIndex;
-
-            return OK;
-        }
-
-        default:
-            TRESPASS();
-            break;
-    }
-}
-
-bool SniffAVI(
-        const sp<DataSource> &source, String8 *mimeType, float *confidence,
-        sp<AMessage> *) {
-    char tmp[12];
-    if (source->readAt(0, tmp, 12) < 12) {
-        return false;
-    }
-
-    if (!memcmp(tmp, "RIFF", 4) && !memcmp(&tmp[8], "AVI ", 4)) {
-        mimeType->setTo(MEDIA_MIMETYPE_CONTAINER_AVI);
-
-        // Just a tad over the mp3 extractor's confidence, since
-        // these .avi files may contain .mp3 content that otherwise would
-        // mistakenly lead to us identifying the entire file as a .mp3 file.
-        *confidence = 0.21;
-
-        return true;
-    }
-
-    return false;
-}
-
-}  // namespace android

--- a/media/libstagefright/codecs/amrwbenc/Android.bp
+++ b/media/libstagefright/codecs/amrwbenc/Android.bp
@@ -129,6 +129,7 @@ cc_library_static {
 
     shared_libs: [
         "libstagefright_enc_common",
+        "liblog",
     ],
 
     cflags: ["-Werror"],

--- a/media/libstagefright/codecs/amrwbenc/SampleCode/Android.bp
+++ b/media/libstagefright/codecs/amrwbenc/SampleCode/Android.bp
@@ -12,6 +12,7 @@ cc_test {
 
     shared_libs: [
         "libdl",
+        "liblog",
     ],
 
     static_libs: [

--- a/media/libstagefright/codecs/amrwbenc/src/c4t64fx.c
+++ b/media/libstagefright/codecs/amrwbenc/src/c4t64fx.c
@@ -47,6 +47,10 @@
 
 #include "q_pulse.h"
 
+#undef LOG_TAG
+#define LOG_TAG "amrwbenc"
+#include "log/log.h"
+
 static Word16 tipos[36] = {
     0, 1, 2, 3,                            /* starting point &ipos[0], 1st iter */
     1, 2, 3, 0,                            /* starting point &ipos[4], 2nd iter */
@@ -745,11 +749,16 @@ void ACELP_4t64_fx(
 
         i = (Word16)((vo_L_mult(track, NPMAXPT) >> 1));
 
-        while (ind[i] >= 0)
+        while (i < NPMAXPT * NB_TRACK && ind[i] >= 0)
         {
             i += 1;
         }
-        ind[i] = index;
+        if (i < NPMAXPT * NB_TRACK) {
+            ind[i] = index;
+        } else {
+            ALOGE("b/132647222, OOB access in ind array track=%d i=%d", track, i);
+            android_errorWriteLog(0x534e4554, "132647222");
+        }
     }
 
     k = 0;

--- a/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/packet_util.cpp
@@ -52,7 +52,11 @@ PV_STATUS PV_ReadVideoPacketHeader(VideoDecData *video, int *next_MB)
         PV_BitstreamByteAlign(stream);
         BitstreamReadBits32(stream, resync_marker_length);
 
-        *next_MB = (int) BitstreamReadBits16(stream, nbits);
+        int mbnum = (int) BitstreamReadBits16(stream, nbits);
+        if (mbnum < 0) {
+            return PV_FAIL;
+        }
+        *next_MB = mbnum;
 //      if (*next_MB <= video->mbnum)   /*  needs more investigation */
 //          *next_MB = video->mbnum+1;
 

--- a/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
+++ b/media/libstagefright/codecs/m4v_h263/dec/src/vop.cpp
@@ -1355,6 +1355,14 @@ PV_STATUS DecodeShortHeader(VideoDecData *video, Vop *currVop)
             int tmpHeight = (tmpDisplayHeight + 15) & -16;
             int tmpWidth = (tmpDisplayWidth + 15) & -16;
 
+            if (tmpWidth > video->width)
+            {
+                // while allowed by the spec, this decoder does not actually
+                // support an increase in size.
+                ALOGE("width increase not supported");
+                status = PV_FAIL;
+                goto return_point;
+            }
             if (tmpHeight * tmpWidth > video->size)
             {
                 // This is just possibly "b/37079296".

--- a/media/libstagefright/httplive/HTTPDownloader.cpp
+++ b/media/libstagefright/httplive/HTTPDownloader.cpp
@@ -157,6 +157,12 @@ ssize_t HTTPDownloader::fetchBlock(
                  buffer->size() + bufferRemaining);
 
             sp<ABuffer> copy = new ABuffer(buffer->size() + bufferRemaining);
+            if (copy->data() == NULL) {
+                android_errorWriteLog(0x534e4554, "68399439");
+                ALOGE("not enough memory to download: requesting %zu + %zu",
+                        buffer->size(), bufferRemaining);
+                return NO_MEMORY;
+            }
             memcpy(copy->data(), buffer->data(), buffer->size());
             copy->setRange(0, buffer->size());
 

--- a/media/libstagefright/omx/1.0/WGraphicBufferProducer.cpp
+++ b/media/libstagefright/omx/1.0/WGraphicBufferProducer.cpp
@@ -40,7 +40,7 @@ Return<void> TWGraphicBufferProducer::requestBuffer(
         int32_t slot, requestBuffer_cb _hidl_cb) {
     sp<GraphicBuffer> buf;
     status_t status = mBase->requestBuffer(slot, &buf);
-    AnwBuffer anwBuffer;
+    AnwBuffer anwBuffer{};
     if (buf != nullptr) {
         wrapAs(&anwBuffer, *buf);
     }
@@ -62,15 +62,15 @@ Return<void> TWGraphicBufferProducer::dequeueBuffer(
         uint32_t width, uint32_t height,
         PixelFormat format, uint32_t usage,
         bool getFrameTimestamps, dequeueBuffer_cb _hidl_cb) {
-    int slot;
+    int slot{};
     sp<Fence> fence;
     ::android::FrameEventHistoryDelta outTimestamps;
     status_t status = mBase->dequeueBuffer(
         &slot, &fence, width, height,
         static_cast<::android::PixelFormat>(format), usage, nullptr,
         getFrameTimestamps ? &outTimestamps : nullptr);
-    hidl_handle tFence;
-    FrameEventHistoryDelta tOutTimestamps;
+    hidl_handle tFence{};
+    FrameEventHistoryDelta tOutTimestamps{};
 
     native_handle_t* nh = nullptr;
     if ((fence == nullptr) || !wrapAs(&tFence, &nh, *fence)) {
@@ -118,8 +118,8 @@ Return<void> TWGraphicBufferProducer::detachNextBuffer(
     sp<GraphicBuffer> outBuffer;
     sp<Fence> outFence;
     status_t status = mBase->detachNextBuffer(&outBuffer, &outFence);
-    AnwBuffer tBuffer;
-    hidl_handle tFence;
+    AnwBuffer tBuffer{};
+    hidl_handle tFence{};
 
     if (outBuffer == nullptr) {
         LOG(ERROR) << "TWGraphicBufferProducer::detachNextBuffer - "
@@ -161,7 +161,7 @@ Return<void> TWGraphicBufferProducer::attachBuffer(
 Return<void> TWGraphicBufferProducer::queueBuffer(
         int32_t slot, const QueueBufferInput& input,
         queueBuffer_cb _hidl_cb) {
-    QueueBufferOutput tOutput;
+    QueueBufferOutput tOutput{};
     BGraphicBufferProducer::QueueBufferInput lInput(
             0, false, HAL_DATASPACE_UNKNOWN,
             ::android::Rect(0, 0, 1, 1),
@@ -223,7 +223,7 @@ Return<void> TWGraphicBufferProducer::connect(
             producerControlledByApp,
             &lOutput);
 
-    QueueBufferOutput tOutput;
+    QueueBufferOutput tOutput{};
     std::vector<std::vector<native_handle_t*> > nhAA;
     if (!wrapAs(&tOutput, &nhAA, lOutput)) {
         LOG(ERROR) << "TWGraphicBufferProducer::connect - "
@@ -295,11 +295,11 @@ Return<void> TWGraphicBufferProducer::getLastQueuedBuffer(
     status_t status = mBase->getLastQueuedBuffer(
             &lOutBuffer, &lOutFence, lOutTransformMatrix);
 
-    AnwBuffer tOutBuffer;
+    AnwBuffer tOutBuffer{};
     if (lOutBuffer != nullptr) {
         wrapAs(&tOutBuffer, *lOutBuffer);
     }
-    hidl_handle tOutFence;
+    hidl_handle tOutFence{};
     native_handle_t* nh = nullptr;
     if ((lOutFence == nullptr) || !wrapAs(&tOutFence, &nh, *lOutFence)) {
         LOG(ERROR) << "TWGraphicBufferProducer::getLastQueuedBuffer - "
@@ -322,7 +322,7 @@ Return<void> TWGraphicBufferProducer::getFrameTimestamps(
     ::android::FrameEventHistoryDelta lDelta;
     mBase->getFrameTimestamps(&lDelta);
 
-    FrameEventHistoryDelta tDelta;
+    FrameEventHistoryDelta tDelta{};
     std::vector<std::vector<native_handle_t*> > nhAA;
     if (!wrapAs(&tDelta, &nhAA, lDelta)) {
         LOG(ERROR) << "TWGraphicBufferProducer::getFrameTimestamps - "
@@ -341,7 +341,7 @@ Return<void> TWGraphicBufferProducer::getFrameTimestamps(
 }
 
 Return<void> TWGraphicBufferProducer::getUniqueId(getUniqueId_cb _hidl_cb) {
-    uint64_t outId;
+    uint64_t outId{};
     status_t status = mBase->getUniqueId(&outId);
     _hidl_cb(static_cast<int32_t>(status), outId);
     return Void();

--- a/media/libstagefright/timedtext/TextDescriptions.cpp
+++ b/media/libstagefright/timedtext/TextDescriptions.cpp
@@ -383,7 +383,7 @@ status_t TextDescriptions::extract3GPPGlobalDescriptions(
         tmpData += 8;
         size_t remaining = size - 8;
 
-        if (size < chunkSize) {
+        if (chunkSize <= 8 || size < chunkSize) {
             return OK;
         }
         switch(chunkType) {

--- a/services/audioflinger/AudioFlinger.cpp
+++ b/services/audioflinger/AudioFlinger.cpp
@@ -2987,9 +2987,13 @@ sp<IEffect> AudioFlinger::createEffect(
             }
             // look for the thread where the specified audio session is present
             for (size_t i = 0; i < mPlaybackThreads.size(); i++) {
-                if (mPlaybackThreads.valueAt(i)->hasAudioSession(sessionId) != 0) {
+                uint32_t sessionType = mPlaybackThreads.valueAt(i)->hasAudioSession(sessionId);
+                if (sessionType != 0) {
                     io = mPlaybackThreads.keyAt(i);
-                    break;
+                    // thread with same effect session is preferable
+                    if ((sessionType & ThreadBase::EFFECT_SESSION) != 0) {
+                        break;
+                    }
                 }
             }
             if (io == AUDIO_IO_HANDLE_NONE) {
@@ -3015,6 +3019,21 @@ sp<IEffect> AudioFlinger::createEffect(
                 io = mPlaybackThreads.keyAt(0);
             }
             ALOGV("createEffect() got io %d for effect %s", io, desc.name);
+        } else if (checkPlaybackThread_l(io) != nullptr) {
+            // allow only one effect chain per sessionId on mPlaybackThreads.
+            for (size_t i = 0; i < mPlaybackThreads.size(); i++) {
+                const audio_io_handle_t checkIo = mPlaybackThreads.keyAt(i);
+                if (io == checkIo) continue;
+                const uint32_t sessionType =
+                        mPlaybackThreads.valueAt(i)->hasAudioSession(sessionId);
+                if ((sessionType & ThreadBase::EFFECT_SESSION) != 0) {
+                    ALOGE("%s: effect %s io %d denied because session %d effect exists on io %d",
+                            __func__, desc.name, (int)io, (int)sessionId, (int)checkIo);
+                    android_errorWriteLog(0x534e4554, "123237974");
+                    lStatus = BAD_VALUE;
+                    goto Exit;
+                }
+            }
         }
         ThreadBase *thread = checkRecordThread_l(io);
         if (thread == NULL) {

--- a/services/audiopolicy/common/managerdefinitions/include/AudioInputDescriptor.h
+++ b/services/audiopolicy/common/managerdefinitions/include/AudioInputDescriptor.h
@@ -27,7 +27,7 @@
 namespace android {
 
 class IOProfile;
-class AudioMix;
+class AudioPolicyMix;
 
 // descriptor for audio inputs. Used to maintain current configuration of each opened audio input
 // and keep track of the usage of this input.
@@ -44,7 +44,7 @@ public:
 
     audio_io_handle_t             mIoHandle;       // input handle
     audio_devices_t               mDevice;         // current device this input is routed to
-    AudioMix                      *mPolicyMix;     // non NULL when used by a dynamic policy
+    wp<AudioPolicyMix>            mPolicyMix;      // non NULL when used by a dynamic policy
     const sp<IOProfile>           mProfile;        // I/O profile this output derives from
 
     virtual void toAudioPortConfig(struct audio_port_config *dstConfig,

--- a/services/audiopolicy/common/managerdefinitions/include/AudioOutputDescriptor.h
+++ b/services/audiopolicy/common/managerdefinitions/include/AudioOutputDescriptor.h
@@ -29,7 +29,7 @@
 namespace android {
 
 class IOProfile;
-class AudioMix;
+class AudioPolicyMix;
 class AudioPolicyClientInterface;
 class DeviceDescriptor;
 
@@ -126,7 +126,7 @@ public:
     audio_io_handle_t mIoHandle;           // output handle
     uint32_t mLatency;                  //
     audio_output_flags_t mFlags;   //
-    AudioMix *mPolicyMix;             // non NULL when used by a dynamic policy
+    wp<AudioPolicyMix> mPolicyMix;           // non NULL when used by a dynamic policy
     sp<SwAudioOutputDescriptor> mOutput1;    // used by duplicated outputs: first output
     sp<SwAudioOutputDescriptor> mOutput2;    // used by duplicated outputs: second output
     uint32_t mDirectOpenCount; // number of clients using this output (direct outputs only)

--- a/services/audiopolicy/common/managerdefinitions/include/AudioPolicyMix.h
+++ b/services/audiopolicy/common/managerdefinitions/include/AudioPolicyMix.h
@@ -29,9 +29,11 @@ class SwAudioOutputDescriptor;
 /**
  * custom mix entry in mPolicyMixes
  */
-class AudioPolicyMix : public RefBase {
+class AudioPolicyMix : public AudioMix, public RefBase {
 public:
-    AudioPolicyMix() {}
+    AudioPolicyMix(const AudioMix &mix);
+    AudioPolicyMix(const AudioPolicyMix&) = delete;
+    AudioPolicyMix& operator=(const AudioPolicyMix&) = delete;
 
     const sp<SwAudioOutputDescriptor> &getOutput() const;
 
@@ -39,14 +41,9 @@ public:
 
     void clearOutput();
 
-    android::AudioMix *getMix();
-
-    void setMix(AudioMix &mix);
-
     status_t dump(int fd, int spaces, int index) const;
 
 private:
-    AudioMix    mMix;                   // Audio policy mix descriptor
     sp<SwAudioOutputDescriptor> mOutput;  // Corresponding output stream
 };
 
@@ -76,9 +73,9 @@ public:
 
     audio_devices_t getDeviceAndMixForInputSource(audio_source_t inputSource,
                                                   audio_devices_t availableDeviceTypes,
-                                                  AudioMix **policyMix);
+                                                  sp<AudioPolicyMix> *policyMix);
 
-    status_t getInputMixForAttr(audio_attributes_t attr, AudioMix **policyMix);
+    status_t getInputMixForAttr(audio_attributes_t attr, sp<AudioPolicyMix> *policyMix);
 
     status_t dump(int fd) const;
 };

--- a/services/audiopolicy/common/managerdefinitions/include/AudioSession.h
+++ b/services/audiopolicy/common/managerdefinitions/include/AudioSession.h
@@ -28,6 +28,7 @@
 namespace android {
 
 class AudioPolicyClientInterface;
+class AudioPolicyMix;
 
 class AudioSession : public RefBase, public AudioSessionInfoUpdateListener
 {
@@ -40,7 +41,7 @@ public:
                  audio_input_flags_t flags,
                  uid_t uid,
                  bool isSoundTrigger,
-                 AudioMix* policyMix,
+                 const sp<AudioPolicyMix> &policyMix,
                  AudioPolicyClientInterface *clientInterface);
 
     status_t dump(int fd, int spaces, int index) const;
@@ -72,7 +73,7 @@ private:
     bool  mIsSoundTrigger;
     uint32_t  mOpenCount;
     uint32_t  mActiveCount;
-    AudioMix* mPolicyMix; // non NULL when used by a dynamic policy
+    wp<AudioPolicyMix> mPolicyMix; // non NULL when used by a dynamic policy
     AudioPolicyClientInterface* mClientInterface;
     const AudioSessionInfoProvider* mInfoProvider;
 };

--- a/services/audiopolicy/common/managerdefinitions/src/AudioInputDescriptor.cpp
+++ b/services/audiopolicy/common/managerdefinitions/src/AudioInputDescriptor.cpp
@@ -20,6 +20,7 @@
 #include "AudioInputDescriptor.h"
 #include "IOProfile.h"
 #include "AudioGain.h"
+#include "AudioPolicyMix.h"
 #include "HwModule.h"
 #include <media/AudioPolicy.h>
 #include <policy.h>

--- a/services/audiopolicy/common/managerdefinitions/src/AudioOutputDescriptor.cpp
+++ b/services/audiopolicy/common/managerdefinitions/src/AudioOutputDescriptor.cpp
@@ -19,6 +19,7 @@
 
 #include <AudioPolicyInterface.h>
 #include "AudioOutputDescriptor.h"
+#include "AudioPolicyMix.h"
 #include "IOProfile.h"
 #include "AudioGain.h"
 #include "Volume.h"
@@ -313,17 +314,18 @@ void SwAudioOutputDescriptor::changeRefCount(audio_stream_type_t stream,
     } else {
         mGlobalRefCount += delta;
     }
+    sp<AudioPolicyMix> policyMix = mPolicyMix.promote();
     if ((oldGlobalRefCount == 0) && (mGlobalRefCount > 0)) {
-        if ((mPolicyMix != NULL) && ((mPolicyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0))
+        if ((policyMix != NULL) && ((policyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0))
         {
-            mClientInterface->onDynamicPolicyMixStateUpdate(mPolicyMix->mDeviceAddress,
+            mClientInterface->onDynamicPolicyMixStateUpdate(policyMix->mDeviceAddress,
                     MIX_STATE_MIXING);
         }
 
     } else if ((oldGlobalRefCount > 0) && (mGlobalRefCount == 0)) {
-        if ((mPolicyMix != NULL) && ((mPolicyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0))
+        if ((policyMix != NULL) && ((policyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0))
         {
-            mClientInterface->onDynamicPolicyMixStateUpdate(mPolicyMix->mDeviceAddress,
+            mClientInterface->onDynamicPolicyMixStateUpdate(policyMix->mDeviceAddress,
                     MIX_STATE_IDLE);
         }
     }

--- a/services/audiopolicy/common/managerdefinitions/src/AudioPolicyMix.cpp
+++ b/services/audiopolicy/common/managerdefinitions/src/AudioPolicyMix.cpp
@@ -27,6 +27,10 @@
 
 namespace android {
 
+AudioPolicyMix::AudioPolicyMix(const AudioMix &mix) : AudioMix(mix)
+{
+}
+
 void AudioPolicyMix::setOutput(sp<SwAudioOutputDescriptor> &output)
 {
     mOutput = output;
@@ -42,16 +46,6 @@ void AudioPolicyMix::clearOutput()
     mOutput.clear();
 }
 
-void AudioPolicyMix::setMix(AudioMix &mix)
-{
-    mMix = mix;
-}
-
-android::AudioMix *AudioPolicyMix::getMix()
-{
-    return &mMix;
-}
-
 status_t AudioPolicyMix::dump(int fd, int spaces, int index) const
 {
     const size_t SIZE = 256;
@@ -61,25 +55,25 @@ status_t AudioPolicyMix::dump(int fd, int spaces, int index) const
     snprintf(buffer, SIZE, "%*sAudio Policy Mix %d:\n", spaces, "", index+1);
     result.append(buffer);
     std::string mixTypeLiteral;
-    if (!MixTypeConverter::toString(mMix.mMixType, mixTypeLiteral)) {
-        ALOGE("%s: failed to convert mix type %d", __FUNCTION__, mMix.mMixType);
+    if (!MixTypeConverter::toString(mMixType, mixTypeLiteral)) {
+        ALOGE("%s: failed to convert mix type %d", __FUNCTION__, mMixType);
         return BAD_VALUE;
     }
     snprintf(buffer, SIZE, "%*s- mix type: %s\n", spaces, "", mixTypeLiteral.c_str());
     result.append(buffer);
     std::string routeFlagLiteral;
-    RouteFlagTypeConverter::maskToString(mMix.mRouteFlags, routeFlagLiteral);
+    RouteFlagTypeConverter::maskToString(mRouteFlags, routeFlagLiteral);
     snprintf(buffer, SIZE, "%*s- Route Flags: %s\n", spaces, "", routeFlagLiteral.c_str());
     result.append(buffer);
     std::string deviceLiteral;
-    deviceToString(mMix.mDeviceType, deviceLiteral);
+    deviceToString(mDeviceType, deviceLiteral);
     snprintf(buffer, SIZE, "%*s- device type: %s\n", spaces, "", deviceLiteral.c_str());
     result.append(buffer);
-    snprintf(buffer, SIZE, "%*s- device address: %s\n", spaces, "", mMix.mDeviceAddress.string());
+    snprintf(buffer, SIZE, "%*s- device address: %s\n", spaces, "", mDeviceAddress.string());
     result.append(buffer);
 
     int indexCriterion = 0;
-    for (const auto &criterion : mMix.mCriteria) {
+    for (const auto &criterion : mCriteria) {
         snprintf(buffer, SIZE, "%*s- Criterion %d:\n", spaces + 2, "", indexCriterion++);
         result.append(buffer);
         std::string usageLiteral;
@@ -89,7 +83,7 @@ status_t AudioPolicyMix::dump(int fd, int spaces, int index) const
         }
         snprintf(buffer, SIZE, "%*s- Usage:%s\n", spaces + 4, "", usageLiteral.c_str());
         result.append(buffer);
-        if (mMix.mMixType == MIX_TYPE_RECORDERS) {
+        if (mMixType == MIX_TYPE_RECORDERS) {
             std::string sourceLiteral;
             if (!SourceTypeConverter::toString(criterion.mValue.mSource, sourceLiteral)) {
                 ALOGE("%s: failed to convert source %d", __FUNCTION__, criterion.mValue.mSource);
@@ -120,12 +114,11 @@ status_t AudioPolicyMixCollection::registerMix(const String8& address, AudioMix
         ALOGE("registerPolicyMixes(): mix for address %s already registered", address.string());
         return BAD_VALUE;
     }
-    sp<AudioPolicyMix> policyMix = new AudioPolicyMix();
-    policyMix->setMix(mix);
+    sp<AudioPolicyMix> policyMix = new AudioPolicyMix(mix);
     add(address, policyMix);
 
     if (desc != 0) {
-        desc->mPolicyMix = policyMix->getMix();
+        desc->mPolicyMix = policyMix;
         policyMix->setOutput(desc);
     }
     return NO_ERROR;
@@ -171,8 +164,7 @@ status_t AudioPolicyMixCollection::getOutputForAttr(audio_attributes_t attribute
     ALOGV("getOutputForAttr() querying %zu mixes:", size());
     desc = 0;
     for (size_t i = 0; i < size(); i++) {
-        sp<AudioPolicyMix> policyMix = valueAt(i);
-        AudioMix *mix = policyMix->getMix();
+        sp<AudioPolicyMix> mix = valueAt(i);
 
         if (mix->mMixType == MIX_TYPE_PLAYERS) {
             // TODO if adding more player rules (currently only 2), make rule handling "generic"
@@ -269,7 +261,7 @@ status_t AudioPolicyMixCollection::getOutputForAttr(audio_attributes_t attribute
                       (hasUidExcludeRules && uidExclusionFound) ||
                       (hasUidMatchRules && !uidMatchFound))) {
                 ALOGV("\tgetOutputForAttr will use mix %zu", i);
-                desc = policyMix->getOutput();
+                desc = mix->getOutput();
             }
 
         } else if (mix->mMixType == MIX_TYPE_RECORDERS) {
@@ -278,7 +270,7 @@ status_t AudioPolicyMixCollection::getOutputForAttr(audio_attributes_t attribute
                     strncmp(attributes.tags + strlen("addr="),
                             mix->mDeviceAddress.string(),
                             AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - strlen("addr=") - 1) == 0) {
-                desc = policyMix->getOutput();
+                desc = mix->getOutput();
             }
         }
         if (desc != 0) {
@@ -289,12 +281,13 @@ status_t AudioPolicyMixCollection::getOutputForAttr(audio_attributes_t attribute
     return BAD_VALUE;
 }
 
-audio_devices_t AudioPolicyMixCollection::getDeviceAndMixForInputSource(audio_source_t inputSource,
-                                                                        audio_devices_t availDevices,
-                                                                        AudioMix **policyMix)
+audio_devices_t AudioPolicyMixCollection::getDeviceAndMixForInputSource(
+        audio_source_t inputSource,
+        audio_devices_t availDevices,
+        sp<AudioPolicyMix> *policyMix)
 {
     for (size_t i = 0; i < size(); i++) {
-        AudioMix *mix = valueAt(i)->getMix();
+        AudioPolicyMix *mix = valueAt(i).get();
 
         if (mix->mMixType != MIX_TYPE_RECORDERS) {
             continue;
@@ -317,7 +310,8 @@ audio_devices_t AudioPolicyMixCollection::getDeviceAndMixForInputSource(audio_so
     return AUDIO_DEVICE_NONE;
 }
 
-status_t AudioPolicyMixCollection::getInputMixForAttr(audio_attributes_t attr, AudioMix **policyMix)
+status_t AudioPolicyMixCollection::getInputMixForAttr(
+        audio_attributes_t attr, sp<AudioPolicyMix> *policyMix)
 {
     if (strncmp(attr.tags, "addr=", strlen("addr=")) != 0) {
         return BAD_VALUE;
@@ -327,8 +321,7 @@ status_t AudioPolicyMixCollection::getInputMixForAttr(audio_attributes_t attr, A
 #ifdef LOG_NDEBUG
     ALOGV("getInputMixForAttr looking for address %s\n  mixes available:", address.string());
     for (size_t i = 0; i < size(); i++) {
-            sp<AudioPolicyMix> policyMix = valueAt(i);
-            AudioMix *mix = policyMix->getMix();
+            sp<AudioPolicyMix> mix = valueAt(i);
             ALOGV("\tmix %zu address=%s", i, mix->mDeviceAddress.string());
     }
 #endif
@@ -339,13 +332,14 @@ status_t AudioPolicyMixCollection::getInputMixForAttr(audio_attributes_t attr, A
         return BAD_VALUE;
     }
     sp<AudioPolicyMix> audioPolicyMix = valueAt(index);
-    AudioMix *mix = audioPolicyMix->getMix();
 
-    if (mix->mMixType != MIX_TYPE_PLAYERS) {
+    if (audioPolicyMix->mMixType != MIX_TYPE_PLAYERS) {
         ALOGW("getInputMixForAttr() bad policy mix type for address %s", address.string());
         return BAD_VALUE;
     }
-    *policyMix = mix;
+    if (policyMix != nullptr) {
+        *policyMix = audioPolicyMix;
+    }
     return NO_ERROR;
 }
 

--- a/services/audiopolicy/common/managerdefinitions/src/AudioSession.cpp
+++ b/services/audiopolicy/common/managerdefinitions/src/AudioSession.cpp
@@ -19,6 +19,7 @@
 
 #include <AudioPolicyInterface.h>
 #include "policy.h"
+#include "AudioPolicyMix.h"
 #include "AudioSession.h"
 #include "AudioGain.h"
 #include "TypeConverter.h"
@@ -36,7 +37,7 @@ AudioSession::AudioSession(audio_session_t session,
                            audio_input_flags_t flags,
                            uid_t uid,
                            bool isSoundTrigger,
-                           AudioMix* policyMix,
+                           const sp<AudioPolicyMix> &policyMix,
                            AudioPolicyClientInterface *clientInterface) :
     mRecordClientInfo({ .uid = uid, .session = session, .source = inputSource}),
     mConfig({ .format = format, .sample_rate = sampleRate, .channel_mask = channelMask}),
@@ -79,9 +80,10 @@ uint32_t AudioSession::changeActiveCount(int delta)
     if (event != RECORD_CONFIG_EVENT_NONE) {
         // Dynamic policy callback:
         // if input maps to a dynamic policy with an activity listener, notify of state change
-        if ((mPolicyMix != NULL) && ((mPolicyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0))
+        sp<AudioPolicyMix> policyMix = mPolicyMix.promote();
+        if ((policyMix != NULL) && ((policyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0))
         {
-            mClientInterface->onDynamicPolicyMixStateUpdate(mPolicyMix->mDeviceAddress,
+            mClientInterface->onDynamicPolicyMixStateUpdate(policyMix->mDeviceAddress,
                     (event == RECORD_CONFIG_EVENT_START) ? MIX_STATE_MIXING : MIX_STATE_IDLE);
         }
 

--- a/services/audiopolicy/managerdefault/AudioPolicyManager.cpp
+++ b/services/audiopolicy/managerdefault/AudioPolicyManager.cpp
@@ -1197,10 +1197,9 @@ status_t AudioPolicyManager::startOutput(audio_io_handle_t output,
     mOutputRoutes.incRouteActivity(session);
 
     audio_devices_t newDevice;
-    AudioMix *policyMix = NULL;
+    sp<AudioPolicyMix> policyMix = outputDesc->mPolicyMix.promote();
     const char *address = NULL;
-    if (outputDesc->mPolicyMix != NULL) {
-        policyMix = outputDesc->mPolicyMix;
+    if (policyMix != NULL) {
         address = policyMix->mDeviceAddress.string();
         if ((policyMix->mRouteFlags & MIX_ROUTE_FLAG_RENDER) == MIX_ROUTE_FLAG_RENDER) {
             newDevice = policyMix->mDeviceType;
@@ -1358,12 +1357,13 @@ status_t AudioPolicyManager::stopOutput(audio_io_handle_t output,
     if (outputDesc->mRefCount[stream] == 1) {
         // Automatically disable the remote submix input when output is stopped on a
         // re routing mix of type MIX_TYPE_RECORDERS
+        sp<AudioPolicyMix> policyMix = outputDesc->mPolicyMix.promote();
         if (audio_is_remote_submix_device(outputDesc->mDevice) &&
-                outputDesc->mPolicyMix != NULL &&
-                outputDesc->mPolicyMix->mMixType == MIX_TYPE_RECORDERS) {
+                policyMix != NULL &&
+                policyMix->mMixType == MIX_TYPE_RECORDERS) {
             setDeviceConnectionStateInt(AUDIO_DEVICE_IN_REMOTE_SUBMIX,
                     AUDIO_POLICY_DEVICE_STATE_UNAVAILABLE,
-                    outputDesc->mPolicyMix->mDeviceAddress,
+                    policyMix->mDeviceAddress,
                     "remote-submix");
         }
     }
@@ -1504,7 +1504,7 @@ status_t AudioPolicyManager::getInputForAttr(const audio_attributes_t *attr,
     String8 address = String8("");
     audio_source_t halInputSource;
     audio_source_t inputSource = attr->source;
-    AudioMix *policyMix = NULL;
+    sp<AudioPolicyMix> policyMix;
     DeviceVector inputDevices;
 
     // Explicit routing?
@@ -1646,7 +1646,7 @@ audio_io_handle_t AudioPolicyManager::getInputForDevice(audio_devices_t device,
                                                         audio_format_t format,
                                                         audio_channel_mask_t channelMask,
                                                         audio_input_flags_t flags,
-                                                        AudioMix *policyMix)
+                                                        const sp<AudioPolicyMix> &policyMix)
 {
     audio_io_handle_t input = AUDIO_IO_HANDLE_NONE;
     audio_source_t halInputSource = inputSource;
@@ -2028,10 +2028,11 @@ status_t AudioPolicyManager::startInput(audio_io_handle_t input,
         setInputDevice(input, device, true /* force */);
 
         if (inputDesc->getAudioSessionCount(true/*activeOnly*/) == 1) {
+            sp<AudioPolicyMix> policyMix = inputDesc->mPolicyMix.promote();
             // if input maps to a dynamic policy with an activity listener, notify of state change
-            if ((inputDesc->mPolicyMix != NULL)
-                    && ((inputDesc->mPolicyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0)) {
-                mpClientInterface->onDynamicPolicyMixStateUpdate(inputDesc->mPolicyMix->mDeviceAddress,
+            if ((policyMix != NULL)
+                    && ((policyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0)) {
+                mpClientInterface->onDynamicPolicyMixStateUpdate(policyMix->mDeviceAddress,
                         MIX_STATE_MIXING);
             }
 
@@ -2046,10 +2047,10 @@ status_t AudioPolicyManager::startInput(audio_io_handle_t input,
             // For remote submix (a virtual device), we open only one input per capture request.
             if (audio_is_remote_submix_device(inputDesc->mDevice)) {
                 String8 address = String8("");
-                if (inputDesc->mPolicyMix == NULL) {
+                if (policyMix == NULL) {
                     address = String8("0");
-                } else if (inputDesc->mPolicyMix->mMixType == MIX_TYPE_PLAYERS) {
-                    address = inputDesc->mPolicyMix->mDeviceAddress;
+                } else if (policyMix->mMixType == MIX_TYPE_PLAYERS) {
+                    address = policyMix->mDeviceAddress;
                 }
                 if (address != "") {
                     setDeviceConnectionStateInt(AUDIO_DEVICE_OUT_REMOTE_SUBMIX,
@@ -2097,10 +2098,11 @@ status_t AudioPolicyManager::stopInput(audio_io_handle_t input,
         if (inputDesc->isActive()) {
             setInputDevice(input, getNewInputDevice(inputDesc), false /* force */);
         } else {
+            sp<AudioPolicyMix> policyMix = inputDesc->mPolicyMix.promote();
             // if input maps to a dynamic policy with an activity listener, notify of state change
-            if ((inputDesc->mPolicyMix != NULL)
-                    && ((inputDesc->mPolicyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0)) {
-                mpClientInterface->onDynamicPolicyMixStateUpdate(inputDesc->mPolicyMix->mDeviceAddress,
+            if ((policyMix != NULL)
+                    && ((policyMix->mCbFlags & AudioMix::kCbFlagNotifyActivity) != 0)) {
+                mpClientInterface->onDynamicPolicyMixStateUpdate(policyMix->mDeviceAddress,
                         MIX_STATE_IDLE);
             }
 
@@ -2108,10 +2110,10 @@ status_t AudioPolicyManager::stopInput(audio_io_handle_t input,
             // used by a policy mix of type MIX_TYPE_RECORDERS
             if (audio_is_remote_submix_device(inputDesc->mDevice)) {
                 String8 address = String8("");
-                if (inputDesc->mPolicyMix == NULL) {
+                if (policyMix == NULL) {
                     address = String8("0");
-                } else if (inputDesc->mPolicyMix->mMixType == MIX_TYPE_PLAYERS) {
-                    address = inputDesc->mPolicyMix->mDeviceAddress;
+                } else if (policyMix->mMixType == MIX_TYPE_PLAYERS) {
+                    address = policyMix->mDeviceAddress;
                 }
                 if (address != "") {
                     setDeviceConnectionStateInt(AUDIO_DEVICE_OUT_REMOTE_SUBMIX,
@@ -4211,7 +4213,7 @@ status_t AudioPolicyManager::checkOutputsForDevice(const sp<DeviceDescriptor>& d
                                   address.string());
                         }
                         policyMix->setOutput(desc);
-                        desc->mPolicyMix = policyMix->getMix();
+                        desc->mPolicyMix = policyMix;
 
                     } else if (((desc->mFlags & AUDIO_OUTPUT_FLAG_DIRECT) == 0) &&
                                     hasPrimaryOutput()) {
@@ -5325,7 +5327,7 @@ sp<IOProfile> AudioPolicyManager::getInputProfile(audio_devices_t device,
 
 
 audio_devices_t AudioPolicyManager::getDeviceAndMixForInputSource(audio_source_t inputSource,
-                                                                  AudioMix **policyMix)
+                                                                  sp<AudioPolicyMix> *policyMix)
 {
     audio_devices_t availableDeviceTypes = mAvailableInputDevices.types() & ~AUDIO_DEVICE_BIT_IN;
     audio_devices_t selectedDeviceFromMix =

--- a/services/audiopolicy/managerdefault/AudioPolicyManager.h
+++ b/services/audiopolicy/managerdefault/AudioPolicyManager.h
@@ -645,7 +645,7 @@ private:
                 audio_format_t format,
                 audio_channel_mask_t channelMask,
                 audio_input_flags_t flags,
-                AudioMix *policyMix);
+                const sp<AudioPolicyMix> &policyMix);
 
         // internal function to derive a stream type value from audio attributes
         audio_stream_type_t streamTypefromAttributesInt(const audio_attributes_t *attr);
@@ -659,7 +659,7 @@ private:
         // select input device corresponding to requested audio source and return associated policy
         // mix if any. Calls getDeviceForInputSource().
         audio_devices_t getDeviceAndMixForInputSource(audio_source_t inputSource,
-                                                        AudioMix **policyMix = NULL);
+                                                      sp<AudioPolicyMix> *policyMix = NULL);
 
         // Called by setDeviceConnectionState().
         status_t setDeviceConnectionStateInt(audio_devices_t device,