Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f1a678f authored by Eric Laurent's avatar Eric Laurent Committed by android-build-merger
Browse files

soundtrigger: add size check on sound model and recogntion data am: ef0c9151... 

soundtrigger: add size check on sound model and recogntion data am: ef0c9151 am: 82477c09 am: 6aa5165f
am: c4d991b2

Change-Id: I3aa665734e6aae7ae4e7f8f32578d8d5bd4937d5
parents 8665ad8c c4d991b2

services/soundtrigger/SoundTriggerHwService.cpp

+30 −8
Original line number Diff line number Diff line
@@ -534,6 +534,22 @@ status_t SoundTriggerHwService::Module::loadSoundModel(const sp<IMemory>& modelM 
    struct sound_trigger_sound_model *sound_model =

            (struct sound_trigger_sound_model *)modelMemory->pointer();



    size_t structSize;

    if (sound_model->type == SOUND_MODEL_TYPE_KEYPHRASE) {

        structSize = sizeof(struct sound_trigger_phrase_sound_model);

    } else {

        structSize = sizeof(struct sound_trigger_sound_model);

    }



    if (sound_model->data_offset < structSize ||

           sound_model->data_size > (UINT_MAX - sound_model->data_offset) ||

           modelMemory->size() < sound_model->data_offset ||

           sound_model->data_size > (modelMemory->size() - sound_model->data_offset)) {

        android_errorWriteLog(0x534e4554, "30148546");

        ALOGE("loadSoundModel() data_size is too big");

        return BAD_VALUE;

    }



    AutoMutex lock(mLock);



    if (mModels.size() >= mDescriptor.properties.max_sound_models) {
@@ -603,11 +619,23 @@ status_t SoundTriggerHwService::Module::startRecognition(sound_model_handle_t ha 
        return PERMISSION_DENIED;

    }



    if (dataMemory != 0 && dataMemory->pointer() == NULL) {

        ALOGE("startRecognition() dataMemory is non-0 but has NULL pointer()");

    if (dataMemory == 0 || dataMemory->pointer() == NULL) {

        ALOGE("startRecognition() dataMemory is 0 or has NULL pointer()");

        return BAD_VALUE;



    }



    struct sound_trigger_recognition_config *config =

            (struct sound_trigger_recognition_config *)dataMemory->pointer();



    if (config->data_offset < sizeof(struct sound_trigger_recognition_config) ||

            config->data_size > (UINT_MAX - config->data_offset) ||

            dataMemory->size() < config->data_offset ||

            config->data_size > (dataMemory->size() - config->data_offset)) {

        ALOGE("startRecognition() data_size is too big");

        return BAD_VALUE;

    }



    AutoMutex lock(mLock);

    if (mServiceState == SOUND_TRIGGER_STATE_DISABLED) {

        return INVALID_OPERATION;
@@ -616,17 +644,11 @@ status_t SoundTriggerHwService::Module::startRecognition(sound_model_handle_t ha 
    if (model == 0) {

        return BAD_VALUE;

    }

    if ((dataMemory == 0) ||

            (dataMemory->size() < sizeof(struct sound_trigger_recognition_config))) {

        return BAD_VALUE;

    }



    if (model->mState == Model::STATE_ACTIVE) {

        return INVALID_OPERATION;

    }



    struct sound_trigger_recognition_config *config =

            (struct sound_trigger_recognition_config *)dataMemory->pointer();



    //TODO: get capture handle and device from audio policy service

    config->capture_handle = model->mCaptureIOHandle;