Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6184728e authored by rago's avatar rago Committed by android-build-merger
Browse files

Fix security vulnerability: Equalizer command might allow negative indexes am:... 

Fix security vulnerability: Equalizer command might allow negative indexes am: e981cca9 am: 8fb82754 am: 6b4cf2c0 am: dd060b3b am: 4bcf2e6f am: 81e09144 am: 3d16a9c4 am: cde28c8a am: 00d12e30 am: 67f8e40f am: 1b1d8e79 am: f386ebab am: 427e1829 am: 635d9559
am: fb35b665

Change-Id: I595408907d99c3466227637f224991510f0a97db
parents 2d588e63 fb35b665

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+15 −3
Original line number Diff line number Diff line
@@ -2357,8 +2357,12 @@ int Equalizer_getParameter(EffectContext *pContext, 


    case EQ_PARAM_BAND_LEVEL:

        param2 = *pParamTemp;

        if (param2 >= FIVEBAND_NUMBANDS) {

        if (param2 < 0 || param2 >= FIVEBAND_NUMBANDS) {

            status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32438598");

                ALOGW("\tERROR Equalizer_getParameter() EQ_PARAM_BAND_LEVEL band %d", param2);

            }

            break;

        }

        *(int16_t *)pValue = (int16_t)EqualizerGetBandLevel(pContext, param2);
@@ -2368,8 +2372,12 @@ int Equalizer_getParameter(EffectContext *pContext, 


    case EQ_PARAM_CENTER_FREQ:

        param2 = *pParamTemp;

        if (param2 >= FIVEBAND_NUMBANDS) {

        if (param2 < 0 || param2 >= FIVEBAND_NUMBANDS) {

            status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32436341");

                ALOGW("\tERROR Equalizer_getParameter() EQ_PARAM_CENTER_FREQ band %d", param2);

            }

            break;

        }

        *(int32_t *)pValue = EqualizerGetCentreFrequency(pContext, param2);
@@ -2379,8 +2387,12 @@ int Equalizer_getParameter(EffectContext *pContext, 


    case EQ_PARAM_BAND_FREQ_RANGE:

        param2 = *pParamTemp;

        if (param2 >= FIVEBAND_NUMBANDS) {

        if (param2 < 0 || param2 >= FIVEBAND_NUMBANDS) {

            status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32247948");

                ALOGW("\tERROR Equalizer_getParameter() EQ_PARAM_BAND_FREQ_RANGE band %d", param2);

            }

            break;

        }

        EqualizerGetBandFreqRange(pContext, param2, (uint32_t *)pValue, ((uint32_t *)pValue + 1));