Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba5a77d7 authored by Andy Hung's avatar Andy Hung Committed by android-build-merger
Browse files

Merge "DO NOT MERGE Fix AudioEffect reply overflow" into mnc-dev am: e29e934c am: a95c6afe 

am: a17042b1

* commit 'a17042b1':
  DO NOT MERGE Fix AudioEffect reply overflow

Change-Id: Ic6a4840abe0e8cac3dae5be5f537412c7dd5c5a4
parents 083f301c a17042b1

post_proc/bundle.c

+3 −2
Original line number Diff line number Diff line
@@ -621,8 +621,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, 
        if (pCmdData == NULL ||

            cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||

            pReplyData == NULL ||

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +

                               sizeof(uint16_t))) {

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||

            // constrain memcpy below

            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

            status = -EINVAL;

            ALOGV("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",

                  cmdSize, *replySize);

voice_processing/voice_processing.c

+3 −1
Original line number Diff line number Diff line
@@ -560,7 +560,9 @@ static int fx_command(effect_handle_t self, 
            if (pCmdData == NULL ||

                    cmdSize < (int)sizeof(effect_param_t) ||

                    pReplyData == NULL ||

                    *replySize < (int)sizeof(effect_param_t)) {

                    *replySize < (int)sizeof(effect_param_t) ||

                    // constrain memcpy below

                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

                ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");

                return -EINVAL;

            }