IAudioPolicyService: Add attribute tags sanitization
When audio_attributes_t was read from the binder parcel, the string tags field was copied without checking that it contained a '\0'. This could lead to read past the end when tags were used. This patch always adds a '\0' at the end of the buffer when deserializing. Bug: 68953950 Test: manual playback/record Test: send binder payload without \0 in tags attribute, check that only AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 char are printed. Change-Id: I285258cbf7cfaf26b191d1f31b3b1e2d724c4934 Merged-In: I285258cbf7cfaf26b191d1f31b3b1e2d724c4934 Signed-off-by: Kevin Rocard <krocard@google.com> (cherry picked from commit 39fdbd09)
Loading
Please register or sign in to comment