Fixed buffer overrun in Symbian QAudioInput backend

Task-number: QTBUG-13058
Reviewed-by: Derick Hawcroft

1 files changed, 6 insertions, 4 deletions

diff --git a/src/multimedia/audio/qaudioinput_symbian_p.cpp b/src/multimedia/audio/qaudioinput_symbian_p.cpp
index 9d240cad30..9ae4368378 100644
--- a/src/multimedia/audio/qaudioinput_symbian_p.cpp
+++ b/src/multimedia/audio/qaudioinput_symbian_p.cpp
@@ -373,7 +373,8 @@ qint64 QAudioInputPrivate::read(char *data, qint64 len)
 
         TDesC8 &inputBuffer = buffer->Data();
 
-        const qint64 inputBytes = bytesReady();
+        Q_ASSERT(inputBuffer.Length() >= m_devSoundBufferPos);
+        const qint64 inputBytes = inputBuffer.Length() - m_devSoundBufferPos;
         const qint64 outputBytes = len - bytesRead;
         const qint64 copyBytes = outputBytes < inputBytes ?
                                      outputBytes : inputBytes;
@@ -384,7 +385,7 @@ qint64 QAudioInputPrivate::read(char *data, qint64 len)
         data += copyBytes;
         bytesRead += copyBytes;
 
-        if (!bytesReady())
+        if (inputBytes == copyBytes)
             bufferEmptied();
     }
 
@@ -403,13 +404,14 @@ void QAudioInputPrivate::pullData()
 
         TDesC8 &inputBuffer = buffer->Data();
 
-        const qint64 inputBytes = bytesReady();
+        Q_ASSERT(inputBuffer.Length() >= m_devSoundBufferPos);
+        const qint64 inputBytes = inputBuffer.Length() - m_devSoundBufferPos;
         const qint64 bytesPushed = m_sink->write(
             (char*)inputBuffer.Ptr() + m_devSoundBufferPos, inputBytes);
 
         m_devSoundBufferPos += bytesPushed;
 
-        if (!bytesReady())
+        if (inputBytes == bytesPushed)
             bufferEmptied();
 
         if (!bytesPushed)