Merge "Fix security vulnerability: Equalizer setParameter memory overflow" into klp-dev (0ef6d9c1) · Commits · e / os / android_frameworks_av

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+31 −3

Original line number	Original line	Diff line number	Diff line
	@@ -145,7 +145,10 @@ int Virtualizer_getParameter (EffectContext *pContext,
	void *pParam,		void *pParam,
	size_t *pValueSize,		size_t *pValueSize,
	void *pValue);		void *pValue);
	int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue);		int Equalizer_setParameter (EffectContext *pContext,
			void *pParam,
			uint32_t valueSize,
			void *pValue);
	int Equalizer_getParameter (EffectContext *pContext,		int Equalizer_getParameter (EffectContext *pContext,
	void *pParam,		void *pParam,
	size_t *pValueSize,		size_t *pValueSize,
	@@ -2187,12 +2190,17 @@ int Equalizer_getParameter(EffectContext *pContext,
	// Inputs:		// Inputs:
	// pEqualizer - handle to instance data		// pEqualizer - handle to instance data
	// pParam - pointer to parameter		// pParam - pointer to parameter
			// valueSize - value size
	// pValue - pointer to value		// pValue - pointer to value

	//		//
	// Outputs:		// Outputs:
	//		//
	//----------------------------------------------------------------------------		//----------------------------------------------------------------------------
	int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue){		int Equalizer_setParameter (EffectContext *pContext,
			void *pParam,
			uint32_t valueSize,
			void *pValue) {
	int status = 0;		int status = 0;
	int32_t preset;		int32_t preset;
	int32_t band;		int32_t band;
	@@ -2204,6 +2212,10 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
	//ALOGV("\tEqualizer_setParameter start");		//ALOGV("\tEqualizer_setParameter start");
	switch (param) {		switch (param) {
	case EQ_PARAM_CUR_PRESET:		case EQ_PARAM_CUR_PRESET:
			if (valueSize < sizeof(int16_t)) {
			status = -EINVAL;
			break;
			}
	preset = (int32_t)((uint16_t )pValue);		preset = (int32_t)((uint16_t )pValue);

	//ALOGV("\tEqualizer_setParameter() EQ_PARAM_CUR_PRESET %d", preset);		//ALOGV("\tEqualizer_setParameter() EQ_PARAM_CUR_PRESET %d", preset);
	@@ -2214,6 +2226,10 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
	EqualizerSetPreset(pContext, preset);		EqualizerSetPreset(pContext, preset);
	break;		break;
	case EQ_PARAM_BAND_LEVEL:		case EQ_PARAM_BAND_LEVEL:
			if (valueSize < sizeof(int16_t)) {
			status = -EINVAL;
			break;
			}
	band = *pParamTemp;		band = *pParamTemp;
	level = (int32_t)((int16_t )pValue);		level = (int32_t)((int16_t )pValue);
	//ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);		//ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);
	@@ -2229,6 +2245,10 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
	break;		break;
	case EQ_PARAM_PROPERTIES: {		case EQ_PARAM_PROPERTIES: {
	//ALOGV("\tEqualizer_setParameter() EQ_PARAM_PROPERTIES");		//ALOGV("\tEqualizer_setParameter() EQ_PARAM_PROPERTIES");
			if (valueSize < sizeof(int16_t)) {
			status = -EINVAL;
			break;
			}
	int16_t p = (int16_t )pValue;		int16_t p = (int16_t )pValue;
	if ((int)p[0] >= EqualizerGetNumPresets()) {		if ((int)p[0] >= EqualizerGetNumPresets()) {
	status = -EINVAL;		status = -EINVAL;
	@@ -2237,6 +2257,13 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
	if (p[0] >= 0) {		if (p[0] >= 0) {
	EqualizerSetPreset(pContext, (int)p[0]);		EqualizerSetPreset(pContext, (int)p[0]);
	} else {		} else {
			if (valueSize < (2 + FIVEBAND_NUMBANDS) * sizeof(int16_t)) {
			android_errorWriteLog(0x534e4554, "37563371");
			ALOGE("\tERROR Equalizer_setParameter() EQ_PARAM_PROPERTIES valueSize %d < %d",
			(int)valueSize, (int)((2 + FIVEBAND_NUMBANDS) * sizeof(int16_t)));
			status = -EINVAL;
			break;
			}
	if ((int)p[1] != FIVEBAND_NUMBANDS) {		if ((int)p[1] != FIVEBAND_NUMBANDS) {
	status = -EINVAL;		status = -EINVAL;
	break;		break;
	@@ -3011,6 +3038,7 @@ int Effect_command(effect_handle_t self,

	(int )pReplyData = android::Equalizer_setParameter(pContext,		(int )pReplyData = android::Equalizer_setParameter(pContext,
	(void *)p->data,		(void *)p->data,
			p->vsize,
	p->data + p->psize);		p->data + p->psize);
	}		}
	if(pContext->EffectType == LVM_VOLUME){		if(pContext->EffectType == LVM_VOLUME){