Check effect command reply size in AudioFlinger

Ticket: CYNGNOS-3177

Bug: 29251553
Change-Id: I1bcc1281f1f0542bb645f6358ce31631f2a8ffbf
(cherry picked from commit 110bc954)

services/audioflinger/Effects.cpp

@@ -640,6 +640,12 @@ status_t AudioFlinger::EffectModule::command(uint32_t cmdCode,
     if (mStatus != NO_ERROR) {
         return mStatus;
     }
+    if (cmdCode == EFFECT_CMD_GET_PARAM &&
+            (*replySize < sizeof(effect_param_t) ||
+                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t))) {
+        android_errorWriteLog(0x534e4554, "29251553");
+        return -EINVAL;
+    }
     status_t status = (*mEffectInterface)->command(mEffectInterface,
                                                    cmdCode,
                                                    cmdSize,