Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6292c152 authored by Ricardo Garcia's avatar Ricardo Garcia Committed by android-build-merger
Browse files

Merge "Fix security vulnerability: Equalizer setParameter memory overflow"... 

Merge "Fix security vulnerability: Equalizer setParameter memory overflow" into klp-dev am: ef3a4aea am: 0ef6d9c1 am: 966e572c am: 1f7d8077 am: a7e658fc am: 6d2092f7 am: 6447404d am: 8693c575 am: 25e3a403 am: 51789f19 am: 7ba75843 am: 5304cbce am: 798dba38 am: fdd5f801 am: cdc2e0a0
am: 3a8678f5

Change-Id: I748d8cd4d23a42f9ef38c1167730c6029f685e7d
parents 022ab29a 3a8678f5

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+31 −3
Original line number Diff line number Diff line
@@ -148,7 +148,10 @@ int Virtualizer_getParameter (EffectContext *pContext, 
                               void           *pParam,

                               uint32_t       *pValueSize,

                               void           *pValue);

int  Equalizer_setParameter    (EffectContext *pContext, void *pParam, void *pValue);

int  Equalizer_setParameter    (EffectContext *pContext,

                               void *pParam,

                               uint32_t valueSize,

                               void *pValue);

int  Equalizer_getParameter    (EffectContext *pContext,

                                void          *pParam,

                                uint32_t      *pValueSize,
@@ -2475,12 +2478,17 @@ int Equalizer_getParameter(EffectContext *pContext, 
// Inputs:

//  pEqualizer    - handle to instance data

//  pParam        - pointer to parameter

//  valueSize     - value size

//  pValue        - pointer to value



//

// Outputs:

//

//----------------------------------------------------------------------------

int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue){

int Equalizer_setParameter (EffectContext *pContext,

                            void *pParam,

                            uint32_t valueSize,

                            void *pValue) {

    int status = 0;

    int32_t preset;

    int32_t band;
@@ -2492,6 +2500,10 @@ int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue) 
    //ALOGV("\tEqualizer_setParameter start");

    switch (param) {

    case EQ_PARAM_CUR_PRESET:

        if (valueSize < sizeof(int16_t)) {

          status = -EINVAL;

          break;

        }

        preset = (int32_t)(*(uint16_t *)pValue);



        //ALOGV("\tEqualizer_setParameter() EQ_PARAM_CUR_PRESET %d", preset);
@@ -2502,6 +2514,10 @@ int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue) 
        EqualizerSetPreset(pContext, preset);

        break;

    case EQ_PARAM_BAND_LEVEL:

        if (valueSize < sizeof(int16_t)) {

          status = -EINVAL;

          break;

        }

        band =  *pParamTemp;

        level = (int32_t)(*(int16_t *)pValue);

        //ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);
@@ -2517,6 +2533,10 @@ int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue) 
        break;

    case EQ_PARAM_PROPERTIES: {

        //ALOGV("\tEqualizer_setParameter() EQ_PARAM_PROPERTIES");

        if (valueSize < sizeof(int16_t)) {

          status = -EINVAL;

          break;

        }

        int16_t *p = (int16_t *)pValue;

        if ((int)p[0] >= EqualizerGetNumPresets()) {

            status = -EINVAL;
@@ -2525,6 +2545,13 @@ int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue) 
        if (p[0] >= 0) {

            EqualizerSetPreset(pContext, (int)p[0]);

        } else {

            if (valueSize < (2 + FIVEBAND_NUMBANDS) * sizeof(int16_t)) {

              android_errorWriteLog(0x534e4554, "37563371");

              ALOGE("\tERROR Equalizer_setParameter() EQ_PARAM_PROPERTIES valueSize %d < %d",

                    (int)valueSize, (int)((2 + FIVEBAND_NUMBANDS) * sizeof(int16_t)));

              status = -EINVAL;

              break;

            }

            if ((int)p[1] != FIVEBAND_NUMBANDS) {

                status = -EINVAL;

                break;
@@ -3297,6 +3324,7 @@ int Effect_command(effect_handle_t self, 


                *(int *)pReplyData = android::Equalizer_setParameter(pContext,

                                                                    (void *)p->data,

                                                                    p->vsize,

                                                                    p->data + p->psize);

            }

            if(pContext->EffectType == LVM_VOLUME){