Merge "Fix security vulnerability: Equalizer setParameter memory overflow" into lmp-dev (b3ad2a04) · Commits · e / devices / Fairphone 4 / android_hardware_qcom_audio

post_proc/equalizer.c

+20 −0

Original line number	Diff line number	Diff line
		@@ -371,6 +371,7 @@ int equalizer_set_parameter(effect_context_t context, effect_param_t p,
		equalizer_context_t eq_ctxt = (equalizer_context_t )context;
		int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);
		void *value = p->data + voffset;
		int32_t vsize = (int32_t) p->vsize;
		int32_t param_tmp = (int32_t )p->data;
		int32_t param = *param_tmp++;
		int32_t preset;
		@@ -385,6 +386,10 @@ int equalizer_set_parameter(effect_context_t context, effect_param_t p,
		switch (param) {
		case EQ_PARAM_CUR_PRESET:
		ALOGV("EQ_PARAM_CUR_PRESET");
		if (vsize < sizeof(int16_t)) {
		p->status = -EINVAL;
		break;
		}
		preset = (int32_t)((uint16_t )value);

		if ((preset >= equalizer_get_num_presets(eq_ctxt)) \|\| (preset < 0)) {
		@@ -395,6 +400,10 @@ int equalizer_set_parameter(effect_context_t context, effect_param_t p,
		break;
		case EQ_PARAM_BAND_LEVEL:
		ALOGV("EQ_PARAM_BAND_LEVEL");
		if (vsize < sizeof(int16_t)) {
		p->status = -EINVAL;
		break;
		}
		band = *param_tmp;
		level = (int32_t)((int16_t )value);
		if (band < 0 \|\| band >= NUM_EQ_BANDS) {
		@@ -409,6 +418,10 @@ int equalizer_set_parameter(effect_context_t context, effect_param_t p,
		break;
		case EQ_PARAM_PROPERTIES: {
		ALOGV("EQ_PARAM_PROPERTIES");
		if (vsize < sizeof(int16_t)) {
		p->status = -EINVAL;
		break;
		}
		int16_t prop = (int16_t )value;
		if ((int)prop[0] >= equalizer_get_num_presets(eq_ctxt)) {
		p->status = -EINVAL;
		@@ -417,6 +430,13 @@ int equalizer_set_parameter(effect_context_t context, effect_param_t p,
		if (prop[0] >= 0) {
		equalizer_set_preset(eq_ctxt, (int)prop[0]);
		} else {
		if (vsize < (2 + NUM_EQ_BANDS) * sizeof(int16_t)) {
		android_errorWriteLog(0x534e4554, "37563371");
		ALOGE("\tERROR EQ_PARAM_PROPERTIES valueSize %d < %d",
		vsize, (2 + NUM_EQ_BANDS) * sizeof(int16_t));
		p->status = -EINVAL;
		break;
		}
		if ((int)prop[1] != NUM_EQ_BANDS) {
		p->status = -EINVAL;
		break;