Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8c42719 authored Apr 28, 2016 by Andy Hung Committed by Gerrit - the friendly Code Review server Aug 31, 2016

DO NOT MERGE Fix AudioEffect reply overflow

Bug: 28173666
Change-Id: I055af37a721b20c5da0f1ec4b02f630dcd5aee02
(cherry picked from commit 57fd9637)

parent 4c4f03ee

post_proc/bundle.c

+3 −2

Original line number	Original line	Diff line number	Diff line
	@@ -828,8 +828,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize,
	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\|
	cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) \|\|		cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) \|\|
	pReplyData == NULL \|\|		pReplyData == NULL \|\|
	*replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +		*replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) \|\|
	sizeof(uint16_t))) {		// constrain memcpy below
			((effect_param_t )pCmdData)->psize > replySize - sizeof(effect_param_t)) {
	status = -EINVAL;		status = -EINVAL;
	ALOGW("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",		ALOGW("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",
	cmdSize, *replySize);		cmdSize, *replySize);

voice_processing/voice_processing.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -564,7 +564,9 @@ static int fx_command(effect_handle_t self,
	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\|
	cmdSize < (int)sizeof(effect_param_t) \|\|		cmdSize < (int)sizeof(effect_param_t) \|\|
	pReplyData == NULL \|\|		pReplyData == NULL \|\|
	*replySize < (int)sizeof(effect_param_t)) {		*replySize < (int)sizeof(effect_param_t) \|\|
			// constrain memcpy below
			((effect_param_t )pCmdData)->psize > replySize - sizeof(effect_param_t)) {
	ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");		ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");
	return -EINVAL;		return -EINVAL;
	}		}