Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a95c6afe authored by Andy Hung's avatar Andy Hung Committed by android-build-merger
Browse files

Merge "DO NOT MERGE Fix AudioEffect reply overflow" into mnc-dev 

am: e29e934c

* commit 'e29e934c':
  DO NOT MERGE Fix AudioEffect reply overflow

Change-Id: I406cee367e0983edf94c328af7e0661e51074bd4
parents 21c641d4 e29e934c

post_proc/bundle.c

+3 −2
Original line number Diff line number Diff line
@@ -621,8 +621,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, 
        if (pCmdData == NULL ||

            cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||

            pReplyData == NULL ||

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +

                               sizeof(uint16_t))) {

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||

            // constrain memcpy below

            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

            status = -EINVAL;

            ALOGV("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",

                  cmdSize, *replySize);

voice_processing/voice_processing.c

+3 −1
Original line number Diff line number Diff line
@@ -560,7 +560,9 @@ static int fx_command(effect_handle_t self, 
            if (pCmdData == NULL ||

                    cmdSize < (int)sizeof(effect_param_t) ||

                    pReplyData == NULL ||

                    *replySize < (int)sizeof(effect_param_t)) {

                    *replySize < (int)sizeof(effect_param_t) ||

                    // constrain memcpy below

                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

                ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");

                return -EINVAL;

            }