The `g729_create()` was previously declared with three arguments:
`(format_parameters, format_parameters_out, format_description**)`
and the mismatch was hidden by casting it to `amci_codec_init_t`.
The core itslef still calls the codec init with two arguments only:
`(format_parameters, fmt_i)`
As a result, the codec never fills the caller's `fmt_i`,
and `*format_description = ...` writes 8 bytes to whatever address
was left in the third argument register.
If that register points to `fmt_i`,
the `AmAudioRtpFormat::initCodec()` then reads uninitialized stack
and may pick a bogus frame size from it
(e.g. seen as `frame_size = 131074`, which then overflowed
the media processor buffer). Otherwise it is a stray write
into an arbitrary memory location on every G.729 stream setup.
Use the two-argument signature, fill the caller's array
(as other codecs do) and drop the cast, so the compiler
validates the signature. Also fix the encoded frame size:
G.729 at 20ms is 20 bytes (33 is the GSM one).
Change-Id: I791c300892bd905b72314c6c84aa3077e71c64fd
Donat Zenichev
b54240881a