Merge "Fix security vulnerability: Equalizer setParameter memory overflow"... (6447404d) · Commits · e / os / android_frameworks_av

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+31 −3

Original line number	Diff line number	Diff line
		@@ -148,7 +148,10 @@ int Virtualizer_getParameter (EffectContext *pContext,
		void *pParam,
		uint32_t *pValueSize,
		void *pValue);
		int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue);
		int Equalizer_setParameter (EffectContext *pContext,
		void *pParam,
		uint32_t valueSize,
		void *pValue);
		int Equalizer_getParameter (EffectContext *pContext,
		void *pParam,
		uint32_t *pValueSize,
		@@ -2477,12 +2480,17 @@ int Equalizer_getParameter(EffectContext *pContext,
		// Inputs:
		// pEqualizer - handle to instance data
		// pParam - pointer to parameter
		// valueSize - value size
		// pValue - pointer to value

		//
		// Outputs:
		//
		//----------------------------------------------------------------------------
		int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue){
		int Equalizer_setParameter (EffectContext *pContext,
		void *pParam,
		uint32_t valueSize,
		void *pValue) {
		int status = 0;
		int32_t preset;
		int32_t band;
		@@ -2494,6 +2502,10 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
		//ALOGV("\tEqualizer_setParameter start");
		switch (param) {
		case EQ_PARAM_CUR_PRESET:
		if (valueSize < sizeof(int16_t)) {
		status = -EINVAL;
		break;
		}
		preset = (int32_t)((uint16_t )pValue);

		//ALOGV("\tEqualizer_setParameter() EQ_PARAM_CUR_PRESET %d", preset);
		@@ -2504,6 +2516,10 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
		EqualizerSetPreset(pContext, preset);
		break;
		case EQ_PARAM_BAND_LEVEL:
		if (valueSize < sizeof(int16_t)) {
		status = -EINVAL;
		break;
		}
		band = *pParamTemp;
		level = (int32_t)((int16_t )pValue);
		//ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);
		@@ -2519,6 +2535,10 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
		break;
		case EQ_PARAM_PROPERTIES: {
		//ALOGV("\tEqualizer_setParameter() EQ_PARAM_PROPERTIES");
		if (valueSize < sizeof(int16_t)) {
		status = -EINVAL;
		break;
		}
		int16_t p = (int16_t )pValue;
		if ((int)p[0] >= EqualizerGetNumPresets()) {
		status = -EINVAL;
		@@ -2527,6 +2547,13 @@ int Equalizer_setParameter (EffectContext pContext, void pParam, void *pValue)
		if (p[0] >= 0) {
		EqualizerSetPreset(pContext, (int)p[0]);
		} else {
		if (valueSize < (2 + FIVEBAND_NUMBANDS) * sizeof(int16_t)) {
		android_errorWriteLog(0x534e4554, "37563371");
		ALOGE("\tERROR Equalizer_setParameter() EQ_PARAM_PROPERTIES valueSize %d < %d",
		(int)valueSize, (int)((2 + FIVEBAND_NUMBANDS) * sizeof(int16_t)));
		status = -EINVAL;
		break;
		}
		if ((int)p[1] != FIVEBAND_NUMBANDS) {
		status = -EINVAL;
		break;
		@@ -3302,6 +3329,7 @@ int Effect_command(effect_handle_t self,

		(int )pReplyData = android::Equalizer_setParameter(pContext,
		(void *)p->data,
		p->vsize,
		p->data + p->psize);
		}
		if(pContext->EffectType == LVM_VOLUME){