IAudioPolicyService: bound array size in queryDefaultPreProcessing (74adca9a) · Commits · e / devices / smdk4412 / android_frameworks_av

include/media/AudioEffect.h

+7 −2

Original line number	Diff line number	Diff line
		@@ -133,10 +133,11 @@ public:
		*
		* Returned value
		* *descriptor updated with descriptors of pre processings enabled by default
		* *count number of descriptors returned if returned status is N_ERROR.
		* *count number of descriptors returned if returned status is NO_ERROR.
		* total number of pre processing enabled by default if returned status is
		* NO_MEMORY. This happens if the count passed as input is less than the number
		* of descriptors to return
		* of descriptors to return.
		* *count is limited to kMaxPreProcessing on return.
		*/
		static status_t queryDefaultPreProcessing(int audioSession,
		effect_descriptor_t *descriptors,
		@@ -391,6 +392,10 @@ public:
		*/
		static status_t guidToString(const effect_uuid_t guid, char str, size_t maxLen);

		// kMaxPreProcessing is a reasonable value for the maximum number of preprocessing effects
		// that can be applied simultaneously.
		static const uint32_t kMaxPreProcessing = 10;

		protected:
		bool mEnabled; // enable state
		int32_t mSessionId; // audio session ID

+6 −3

Original line number	Diff line number	Diff line
		@@ -23,6 +23,7 @@

		#include <binder/Parcel.h>

		#include <media/AudioEffect.h>
		#include <media/IAudioPolicyService.h>

		#include <system/audio.h>
		@@ -916,16 +917,18 @@ status_t BnAudioPolicyService::onTransact(
		CHECK_INTERFACE(IAudioPolicyService, data, reply);
		int audioSession = data.readInt32();
		uint32_t count = data.readInt32();
		if (count > AudioEffect::kMaxPreProcessing) {
		count = AudioEffect::kMaxPreProcessing;
		}
		uint32_t retCount = count;
		effect_descriptor_t *descriptors =
		(effect_descriptor_t )new char[count sizeof(effect_descriptor_t)];
		effect_descriptor_t *descriptors = new effect_descriptor_t[count];
		status_t status = queryDefaultPreProcessing(audioSession, descriptors, &retCount);
		reply->writeInt32(status);
		if (status != NO_ERROR && status != NO_MEMORY) {
		retCount = 0;
		}
		reply->writeInt32(retCount);
		if (retCount) {
		if (retCount != 0) {
		if (retCount < count) {
		count = retCount;
		}