Merge "audio effects: fix heap overflow" into mnc-dev (81e998b0) · Commits · e / os / android_frameworks_av

media/libeffects/downmix/EffectDownmix.c

+9 −9

Original line number	Original line	Diff line number	Diff line
	@@ -149,8 +149,8 @@ void Downmix_testIndexComputation(uint32_t mask) {
	/--- Effect Library Interface Implementation ---/		/--- Effect Library Interface Implementation ---/

	int32_t DownmixLib_Create(const effect_uuid_t *uuid,		int32_t DownmixLib_Create(const effect_uuid_t *uuid,
	int32_t sessionId,		int32_t sessionId __unused,
	int32_t ioId,		int32_t ioId __unused,
	effect_handle_t *pHandle) {		effect_handle_t *pHandle) {
	int ret;		int ret;
	int i;		int i;
	@@ -370,7 +370,7 @@ static int Downmix_Command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdS

	switch (cmdCode) {		switch (cmdCode) {
	case EFFECT_CMD_INIT:		case EFFECT_CMD_INIT:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)) {		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	return -EINVAL;		return -EINVAL;
	}		}
	(int ) pReplyData = Downmix_Init(pDwmModule);		(int ) pReplyData = Downmix_Init(pDwmModule);
	@@ -378,7 +378,7 @@ static int Downmix_Command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdS

	case EFFECT_CMD_SET_CONFIG:		case EFFECT_CMD_SET_CONFIG:
	if (pCmdData == NULL \|\| cmdSize != sizeof(effect_config_t)		if (pCmdData == NULL \|\| cmdSize != sizeof(effect_config_t)
	\|\| pReplyData == NULL \|\| *replySize != sizeof(int)) {		\|\| pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	return -EINVAL;		return -EINVAL;
	}		}
	(int ) pReplyData = Downmix_Configure(pDwmModule,		(int ) pReplyData = Downmix_Configure(pDwmModule,
	@@ -393,7 +393,7 @@ static int Downmix_Command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdS
	ALOGV("Downmix_Command EFFECT_CMD_GET_PARAM pCmdData %p, *replySize %" PRIu32 ", pReplyData: %p",		ALOGV("Downmix_Command EFFECT_CMD_GET_PARAM pCmdData %p, *replySize %" PRIu32 ", pReplyData: %p",
	pCmdData, *replySize, pReplyData);		pCmdData, *replySize, pReplyData);
	if (pCmdData == NULL \|\| cmdSize < (int)(sizeof(effect_param_t) + sizeof(int32_t)) \|\|		if (pCmdData == NULL \|\| cmdSize < (int)(sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL \|\|		pReplyData == NULL \|\| replySize == NULL \|\|
	replySize < (int) sizeof(effect_param_t) + 2 sizeof(int32_t)) {		replySize < (int) sizeof(effect_param_t) + 2 sizeof(int32_t)) {
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -410,7 +410,7 @@ static int Downmix_Command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdS
	ALOGV("Downmix_Command EFFECT_CMD_SET_PARAM cmdSize %d pCmdData %p, *replySize %" PRIu32		ALOGV("Downmix_Command EFFECT_CMD_SET_PARAM cmdSize %d pCmdData %p, *replySize %" PRIu32
	", pReplyData %p", cmdSize, pCmdData, *replySize, pReplyData);		", pReplyData %p", cmdSize, pCmdData, *replySize, pReplyData);
	if (pCmdData == NULL \|\| (cmdSize < (int)(sizeof(effect_param_t) + sizeof(int32_t)))		if (pCmdData == NULL \|\| (cmdSize < (int)(sizeof(effect_param_t) + sizeof(int32_t)))
	\|\| pReplyData == NULL \|\| *replySize != (int)sizeof(int32_t)) {		\|\| pReplyData == NULL \|\| replySize == NULL \|\| *replySize != (int)sizeof(int32_t)) {
	return -EINVAL;		return -EINVAL;
	}		}
	effect_param_t cmd = (effect_param_t ) pCmdData;		effect_param_t cmd = (effect_param_t ) pCmdData;
	@@ -429,7 +429,7 @@ static int Downmix_Command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdS
	break;		break;

	case EFFECT_CMD_ENABLE:		case EFFECT_CMD_ENABLE:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)) {		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	return -EINVAL;		return -EINVAL;
	}		}
	if (pDownmixer->state != DOWNMIX_STATE_INITIALIZED) {		if (pDownmixer->state != DOWNMIX_STATE_INITIALIZED) {
	@@ -441,7 +441,7 @@ static int Downmix_Command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdS
	break;		break;

	case EFFECT_CMD_DISABLE:		case EFFECT_CMD_DISABLE:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)) {		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	return -EINVAL;		return -EINVAL;
	}		}
	if (pDownmixer->state != DOWNMIX_STATE_ACTIVE) {		if (pDownmixer->state != DOWNMIX_STATE_ACTIVE) {
	@@ -659,7 +659,7 @@ int Downmix_Configure(downmix_module_t pDwmModule, effect_config_t pConfig, bo
	*----------------------------------------------------------------------------		*----------------------------------------------------------------------------
	*/		*/

	int Downmix_Reset(downmix_object_t *pDownmixer, bool init) {		int Downmix_Reset(downmix_object_t *pDownmixer __unused, bool init __unused) {
	// nothing to do here		// nothing to do here
	return 0;		return 0;
	}		}

media/libeffects/loudness/EffectLoudnessEnhancer.cpp

+6 −6

Original line number	Original line	Diff line number	Diff line
	@@ -189,8 +189,8 @@ int LE_init(LoudnessEnhancerContext *pContext)
	//		//

	int LELib_Create(const effect_uuid_t *uuid,		int LELib_Create(const effect_uuid_t *uuid,
	int32_t sessionId,		int32_t sessionId __unused,
	int32_t ioId,		int32_t ioId __unused,
	effect_handle_t *pHandle) {		effect_handle_t *pHandle) {
	ALOGV("LELib_Create()");		ALOGV("LELib_Create()");
	int ret;		int ret;
	@@ -327,7 +327,7 @@ int LE_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize,
	break;		break;
	case EFFECT_CMD_SET_CONFIG:		case EFFECT_CMD_SET_CONFIG:
	if (pCmdData == NULL \|\| cmdSize != sizeof(effect_config_t)		if (pCmdData == NULL \|\| cmdSize != sizeof(effect_config_t)
	\|\| pReplyData == NULL \|\| *replySize != sizeof(int)) {		\|\| pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	return -EINVAL;		return -EINVAL;
	}		}
	(int ) pReplyData = LE_setConfig(pContext,		(int ) pReplyData = LE_setConfig(pContext,
	@@ -344,7 +344,7 @@ int LE_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize,
	LE_reset(pContext);		LE_reset(pContext);
	break;		break;
	case EFFECT_CMD_ENABLE:		case EFFECT_CMD_ENABLE:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)) {		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	return -EINVAL;		return -EINVAL;
	}		}
	if (pContext->mState != LOUDNESS_ENHANCER_STATE_INITIALIZED) {		if (pContext->mState != LOUDNESS_ENHANCER_STATE_INITIALIZED) {
	@@ -368,7 +368,7 @@ int LE_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize,
	case EFFECT_CMD_GET_PARAM: {		case EFFECT_CMD_GET_PARAM: {
	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\|
	cmdSize != (int)(sizeof(effect_param_t) + sizeof(uint32_t)) \|\|		cmdSize != (int)(sizeof(effect_param_t) + sizeof(uint32_t)) \|\|
	pReplyData == NULL \|\|		pReplyData == NULL \|\| replySize == NULL \|\|
	*replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint32_t))) {		*replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint32_t))) {
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -394,7 +394,7 @@ int LE_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize,
	case EFFECT_CMD_SET_PARAM: {		case EFFECT_CMD_SET_PARAM: {
	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\|
	cmdSize != (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint32_t)) \|\|		cmdSize != (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint32_t)) \|\|
	pReplyData == NULL \|\| *replySize != sizeof(int32_t)) {		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int32_t)) {
	return -EINVAL;		return -EINVAL;
	}		}
	(int32_t )pReplyData = 0;		(int32_t )pReplyData = 0;

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+40 −94

Original line number	Original line	Diff line number	Diff line
	@@ -3034,7 +3034,7 @@ int Effect_command(effect_handle_t self,

	switch (cmdCode){		switch (cmdCode){
	case EFFECT_CMD_INIT:		case EFFECT_CMD_INIT:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)){		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)){
	ALOGV("\tLVM_ERROR, EFFECT_CMD_INIT: ERROR for effect type %d",		ALOGV("\tLVM_ERROR, EFFECT_CMD_INIT: ERROR for effect type %d",
	pContext->EffectType);		pContext->EffectType);
	return -EINVAL;		return -EINVAL;
	@@ -3061,10 +3061,8 @@ int Effect_command(effect_handle_t self,

	case EFFECT_CMD_SET_CONFIG:		case EFFECT_CMD_SET_CONFIG:
	//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_SET_CONFIG start");		//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_SET_CONFIG start");
	if (pCmdData == NULL\|\|		if (pCmdData == NULL \|\| cmdSize != sizeof(effect_config_t) \|\|
	cmdSize != sizeof(effect_config_t)\|\|		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	pReplyData == NULL\|\|
	*replySize != sizeof(int)){
	ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: "
	"EFFECT_CMD_SET_CONFIG: ERROR");		"EFFECT_CMD_SET_CONFIG: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -3074,8 +3072,7 @@ int Effect_command(effect_handle_t self,
	break;		break;

	case EFFECT_CMD_GET_CONFIG:		case EFFECT_CMD_GET_CONFIG:
	if (pReplyData == NULL \|\|		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(effect_config_t)) {
	*replySize != sizeof(effect_config_t)) {
	ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: "
	"EFFECT_CMD_GET_CONFIG: ERROR");		"EFFECT_CMD_GET_CONFIG: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -3093,16 +3090,15 @@ int Effect_command(effect_handle_t self,
	case EFFECT_CMD_GET_PARAM:{		case EFFECT_CMD_GET_PARAM:{
	//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM start");		//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM start");

	if(pContext->EffectType == LVM_BASS_BOOST){		effect_param_t p = (effect_param_t )pCmdData;
	if (pCmdData == NULL \|\|
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|		if (pCmdData == NULL \|\| cmdSize < sizeof(effect_param_t) \|\|
	pReplyData == NULL \|\|		cmdSize < (sizeof(effect_param_t) + p->psize) \|\|
	*replySize < (sizeof(effect_param_t) + sizeof(int32_t))){		pReplyData == NULL \|\| replySize == NULL \|\|
	ALOGV("\tLVM_ERROR : BassBoost_command cmdCode Case: "		*replySize < (sizeof(effect_param_t) + p->psize)) {
	"EFFECT_CMD_GET_PARAM: ERROR");		ALOGV("\tLVM_ERROR : EFFECT_CMD_GET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	effect_param_t p = (effect_param_t )pCmdData;

	memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);		memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);

	@@ -3110,13 +3106,11 @@ int Effect_command(effect_handle_t self,

	int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);		int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);

			if(pContext->EffectType == LVM_BASS_BOOST){
	p->status = android::BassBoost_getParameter(pContext,		p->status = android::BassBoost_getParameter(pContext,
	p->data,		p->data,
	&p->vsize,		&p->vsize,
	p->data + voffset);		p->data + voffset);

	*replySize = sizeof(effect_param_t) + voffset + p->vsize;

	//ALOGV("\tBassBoost_command EFFECT_CMD_GET_PARAM "		//ALOGV("\tBassBoost_command EFFECT_CMD_GET_PARAM "
	// "pCmdData %d, replySize %d, *pReplyData %d ",		// "pCmdData %d, replySize %d, *pReplyData %d ",
	// (int32_t )((char *)pCmdData + sizeof(effect_param_t)),		// (int32_t )((char *)pCmdData + sizeof(effect_param_t)),
	@@ -3125,27 +3119,10 @@ int Effect_command(effect_handle_t self,
	}		}

	if(pContext->EffectType == LVM_VIRTUALIZER){		if(pContext->EffectType == LVM_VIRTUALIZER){
	if (pCmdData == NULL \|\|
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL \|\|
	*replySize < (sizeof(effect_param_t) + sizeof(int32_t))){
	ALOGV("\tLVM_ERROR : Virtualizer_command cmdCode Case: "
	"EFFECT_CMD_GET_PARAM: ERROR");
	return -EINVAL;
	}
	effect_param_t p = (effect_param_t )pCmdData;

	memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);

	p = (effect_param_t *)pReplyData;

	int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);

	p->status = android::Virtualizer_getParameter(pContext,		p->status = android::Virtualizer_getParameter(pContext,
	(void *)p->data,		(void *)p->data,
	&p->vsize,		&p->vsize,
	p->data + voffset);		p->data + voffset);
	*replySize = sizeof(effect_param_t) + voffset + p->vsize;

	//ALOGV("\tVirtualizer_command EFFECT_CMD_GET_PARAM "		//ALOGV("\tVirtualizer_command EFFECT_CMD_GET_PARAM "
	// "pCmdData %d, replySize %d, *pReplyData %d ",		// "pCmdData %d, replySize %d, *pReplyData %d ",
	@@ -3156,29 +3133,11 @@ int Effect_command(effect_handle_t self,
	if(pContext->EffectType == LVM_EQUALIZER){		if(pContext->EffectType == LVM_EQUALIZER){
	//ALOGV("\tEqualizer_command cmdCode Case: "		//ALOGV("\tEqualizer_command cmdCode Case: "
	// "EFFECT_CMD_GET_PARAM start");		// "EFFECT_CMD_GET_PARAM start");
	if (pCmdData == NULL \|\|
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL \|\|
	*replySize < (int) (sizeof(effect_param_t) + sizeof(int32_t))) {
	ALOGV("\tLVM_ERROR : Equalizer_command cmdCode Case: "
	"EFFECT_CMD_GET_PARAM");
	return -EINVAL;
	}
	effect_param_t p = (effect_param_t )pCmdData;

	memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);

	p = (effect_param_t *)pReplyData;

	int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);

	p->status = android::Equalizer_getParameter(pContext,		p->status = android::Equalizer_getParameter(pContext,
	p->data,		p->data,
	&p->vsize,		&p->vsize,
	p->data + voffset);		p->data + voffset);

	*replySize = sizeof(effect_param_t) + voffset + p->vsize;

	//ALOGV("\tEqualizer_command EFFECT_CMD_GET_PARAM pCmdData %d, replySize %d, "		//ALOGV("\tEqualizer_command EFFECT_CMD_GET_PARAM pCmdData %d, replySize %d, "
	// "*pReplyData %08x %08x",		// "*pReplyData %08x %08x",
	// (int32_t )((char )pCmdData + sizeof(effect_param_t)), replySize,		// (int32_t )((char )pCmdData + sizeof(effect_param_t)), replySize,
	@@ -3188,35 +3147,19 @@ int Effect_command(effect_handle_t self,
	}		}
	if(pContext->EffectType == LVM_VOLUME){		if(pContext->EffectType == LVM_VOLUME){
	//ALOGV("\tVolume_command cmdCode Case: EFFECT_CMD_GET_PARAM start");		//ALOGV("\tVolume_command cmdCode Case: EFFECT_CMD_GET_PARAM start");
	if (pCmdData == NULL \|\|
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL \|\|
	*replySize < (int) (sizeof(effect_param_t) + sizeof(int32_t))){
	ALOGV("\tLVM_ERROR : Volume_command cmdCode Case: "
	"EFFECT_CMD_GET_PARAM: ERROR");
	return -EINVAL;
	}
	effect_param_t p = (effect_param_t )pCmdData;

	memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);

	p = (effect_param_t *)pReplyData;

	int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);

	p->status = android::Volume_getParameter(pContext,		p->status = android::Volume_getParameter(pContext,
	(void *)p->data,		(void *)p->data,
	&p->vsize,		&p->vsize,
	p->data + voffset);		p->data + voffset);

	*replySize = sizeof(effect_param_t) + voffset + p->vsize;

	//ALOGV("\tVolume_command EFFECT_CMD_GET_PARAM "		//ALOGV("\tVolume_command EFFECT_CMD_GET_PARAM "
	// "pCmdData %d, replySize %d, *pReplyData %d ",		// "pCmdData %d, replySize %d, *pReplyData %d ",
	// (int32_t )((char *)pCmdData + sizeof(effect_param_t)),		// (int32_t )((char *)pCmdData + sizeof(effect_param_t)),
	// *replySize,		// *replySize,
	// (int16_t )((char *)pReplyData + sizeof(effect_param_t) + voffset));		// (int16_t )((char *)pReplyData + sizeof(effect_param_t) + voffset));
	}		}
			*replySize = sizeof(effect_param_t) + voffset + p->vsize;

	//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM end");		//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM end");
	} break;		} break;
	case EFFECT_CMD_SET_PARAM:{		case EFFECT_CMD_SET_PARAM:{
	@@ -3229,8 +3172,7 @@ int Effect_command(effect_handle_t self,

	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\|
	cmdSize != (sizeof(effect_param_t) + sizeof(int32_t) +sizeof(int16_t)) \|\|		cmdSize != (sizeof(effect_param_t) + sizeof(int32_t) +sizeof(int16_t)) \|\|
	pReplyData == NULL\|\|		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int32_t)) {
	*replySize != sizeof(int32_t)){
	ALOGV("\tLVM_ERROR : BassBoost_command cmdCode Case: "		ALOGV("\tLVM_ERROR : BassBoost_command cmdCode Case: "
	"EFFECT_CMD_SET_PARAM: ERROR");		"EFFECT_CMD_SET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -3265,8 +3207,7 @@ int Effect_command(effect_handle_t self,
	// legal parameters are int16_t or int32_t		// legal parameters are int16_t or int32_t
	cmdSize > (sizeof(effect_param_t) + sizeof(int32_t) +sizeof(int32_t)) \|\|		cmdSize > (sizeof(effect_param_t) + sizeof(int32_t) +sizeof(int32_t)) \|\|
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t) +sizeof(int16_t)) \|\|		cmdSize < (sizeof(effect_param_t) + sizeof(int32_t) +sizeof(int16_t)) \|\|
	pReplyData == NULL \|\|		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int32_t)) {
	*replySize != sizeof(int32_t)){
	ALOGV("\tLVM_ERROR : Virtualizer_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Virtualizer_command cmdCode Case: "
	"EFFECT_CMD_SET_PARAM: ERROR");		"EFFECT_CMD_SET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -3299,7 +3240,7 @@ int Effect_command(effect_handle_t self,
	// (int16_t )((char *)pCmdData + sizeof(effect_param_t) + sizeof(int32_t)));		// (int16_t )((char *)pCmdData + sizeof(effect_param_t) + sizeof(int32_t)));

	if (pCmdData == NULL \|\| cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|		if (pCmdData == NULL \|\| cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL \|\| *replySize != sizeof(int32_t)) {		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int32_t)) {
	ALOGV("\tLVM_ERROR : Equalizer_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Equalizer_command cmdCode Case: "
	"EFFECT_CMD_SET_PARAM: ERROR");		"EFFECT_CMD_SET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -3319,7 +3260,7 @@ int Effect_command(effect_handle_t self,

	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\|
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|		cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL\|\|		pReplyData == NULL \|\| replySize == NULL \|\|
	*replySize != sizeof(int32_t)) {		*replySize != sizeof(int32_t)) {
	ALOGV("\tLVM_ERROR : Volume_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Volume_command cmdCode Case: "
	"EFFECT_CMD_SET_PARAM: ERROR");		"EFFECT_CMD_SET_PARAM: ERROR");
	@@ -3336,7 +3277,7 @@ int Effect_command(effect_handle_t self,

	case EFFECT_CMD_ENABLE:		case EFFECT_CMD_ENABLE:
	ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_ENABLE start");		ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_ENABLE start");
	if (pReplyData == NULL \|\| *replySize != sizeof(int)){		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: EFFECT_CMD_ENABLE: ERROR");		ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: EFFECT_CMD_ENABLE: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -3346,7 +3287,7 @@ int Effect_command(effect_handle_t self,

	case EFFECT_CMD_DISABLE:		case EFFECT_CMD_DISABLE:
	//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_DISABLE start");		//ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_DISABLE start");
	if (pReplyData == NULL \|\| *replySize != sizeof(int)){		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: EFFECT_CMD_DISABLE: ERROR");		ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: EFFECT_CMD_DISABLE: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -3356,6 +3297,11 @@ int Effect_command(effect_handle_t self,
	case EFFECT_CMD_SET_DEVICE:		case EFFECT_CMD_SET_DEVICE:
	{		{
	ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_SET_DEVICE start");		ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_SET_DEVICE start");
			if (pCmdData == NULL){
			ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: EFFECT_CMD_SET_DEVICE: ERROR");
			return -EINVAL;
			}

	uint32_t device = (uint32_t )pCmdData;		uint32_t device = (uint32_t )pCmdData;
	pContext->pBundledContext->nOutputDevice = (audio_devices_t) device;		pContext->pBundledContext->nOutputDevice = (audio_devices_t) device;

	@@ -3444,8 +3390,8 @@ int Effect_command(effect_handle_t self,
	break;		break;
	}		}

	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\| cmdSize != 2 * sizeof(uint32_t) \|\| pReplyData == NULL \|\|
	cmdSize != 2 * sizeof(uint32_t)) {		replySize == NULL \|\| replySize < 2sizeof(int32_t)) {
	ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Effect_command cmdCode Case: "
	"EFFECT_CMD_SET_VOLUME: ERROR");		"EFFECT_CMD_SET_VOLUME: ERROR");
	return -EINVAL;		return -EINVAL;

media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp

+14 −16

Original line number	Original line	Diff line number	Diff line
	@@ -190,8 +190,8 @@ int Reverb_LoadPreset (ReverbContext *pContext);
	/* Effect Library Interface Implementation */		/* Effect Library Interface Implementation */

	extern "C" int EffectCreate(const effect_uuid_t *uuid,		extern "C" int EffectCreate(const effect_uuid_t *uuid,
	int32_t sessionId,		int32_t sessionId __unused,
	int32_t ioId,		int32_t ioId __unused,
	effect_handle_t *pHandle){		effect_handle_t *pHandle){
	int ret;		int ret;
	int i;		int i;
	@@ -1915,7 +1915,7 @@ int Reverb_command(effect_handle_t self,
	//ALOGV("\tReverb_command cmdCode Case: "		//ALOGV("\tReverb_command cmdCode Case: "
	// "EFFECT_CMD_INIT start");		// "EFFECT_CMD_INIT start");

	if (pReplyData == NULL \|\| *replySize != sizeof(int)){		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)){
	ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "
	"EFFECT_CMD_INIT: ERROR");		"EFFECT_CMD_INIT: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -1926,10 +1926,8 @@ int Reverb_command(effect_handle_t self,
	case EFFECT_CMD_SET_CONFIG:		case EFFECT_CMD_SET_CONFIG:
	//ALOGV("\tReverb_command cmdCode Case: "		//ALOGV("\tReverb_command cmdCode Case: "
	// "EFFECT_CMD_SET_CONFIG start");		// "EFFECT_CMD_SET_CONFIG start");
	if (pCmdData == NULL \|\|		if (pCmdData == NULL \|\| cmdSize != sizeof(effect_config_t) \|\|
	cmdSize != sizeof(effect_config_t) \|\|		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)) {
	pReplyData == NULL \|\|
	*replySize != sizeof(int)) {
	ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "
	"EFFECT_CMD_SET_CONFIG: ERROR");		"EFFECT_CMD_SET_CONFIG: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -1939,8 +1937,7 @@ int Reverb_command(effect_handle_t self,
	break;		break;

	case EFFECT_CMD_GET_CONFIG:		case EFFECT_CMD_GET_CONFIG:
	if (pReplyData == NULL \|\|		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(effect_config_t)) {
	*replySize != sizeof(effect_config_t)) {
	ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "
	"EFFECT_CMD_GET_CONFIG: ERROR");		"EFFECT_CMD_GET_CONFIG: ERROR");
	return -EINVAL;		return -EINVAL;
	@@ -1958,15 +1955,16 @@ int Reverb_command(effect_handle_t self,
	case EFFECT_CMD_GET_PARAM:{		case EFFECT_CMD_GET_PARAM:{
	//ALOGV("\tReverb_command cmdCode Case: "		//ALOGV("\tReverb_command cmdCode Case: "
	// "EFFECT_CMD_GET_PARAM start");		// "EFFECT_CMD_GET_PARAM start");
	if (pCmdData == NULL \|\|		effect_param_t p = (effect_param_t )pCmdData;
	cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)) \|\|
	pReplyData == NULL \|\|		if (pCmdData == NULL \|\| cmdSize < sizeof(effect_param_t) \|\|
	*replySize < (sizeof(effect_param_t) + sizeof(int32_t))){		cmdSize < (sizeof(effect_param_t) + p->psize) \|\|
			pReplyData == NULL \|\| replySize == NULL \|\|
			*replySize < (sizeof(effect_param_t) + p->psize)) {
	ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "
	"EFFECT_CMD_GET_PARAM: ERROR");		"EFFECT_CMD_GET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	effect_param_t p = (effect_param_t )pCmdData;

	memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);		memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);

	@@ -1997,8 +1995,8 @@ int Reverb_command(effect_handle_t self,
	// *replySize,		// *replySize,
	// (int16_t )((char *)pCmdData + sizeof(effect_param_t) + sizeof(int32_t)));		// (int16_t )((char *)pCmdData + sizeof(effect_param_t) + sizeof(int32_t)));

	if (pCmdData == NULL \|\| (cmdSize < (sizeof(effect_param_t) + sizeof(int32_t)))		if (pCmdData == NULL \|\| (cmdSize < (sizeof(effect_param_t) + sizeof(int32_t))) \|\|
	\|\| pReplyData == NULL \|\| *replySize != sizeof(int32_t)) {		pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int32_t)) {
	ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "		ALOGV("\tLVM_ERROR : Reverb_command cmdCode Case: "
	"EFFECT_CMD_SET_PARAM: ERROR");		"EFFECT_CMD_SET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;

media/libeffects/preprocessing/PreProcessing.cpp

+19 −16

Original line number	Original line	Diff line number	Diff line
	@@ -575,16 +575,18 @@ int NsCreate(preproc_effect_t *effect)
	return 0;		return 0;
	}		}

	int NsGetParameter(preproc_effect_t *effect,		int NsGetParameter(preproc_effect_t *effect __unused,
	void *pParam,		void *pParam __unused,
	uint32_t *pValueSize,		uint32_t *pValueSize __unused,
	void *pValue)		void *pValue __unused)
	{		{
	int status = 0;		int status = 0;
	return status;		return status;
	}		}

	int NsSetParameter (preproc_effect_t effect, void pParam, void *pValue)		int NsSetParameter (preproc_effect_t *effect __unused,
			void *pParam __unused,
			void *pValue __unused)
	{		{
	int status = 0;		int status = 0;
	return status;		return status;
	@@ -1435,15 +1437,16 @@ int PreProcessingFx_Command(effect_handle_t self,
	break;		break;

	case EFFECT_CMD_GET_PARAM: {		case EFFECT_CMD_GET_PARAM: {
	if (pCmdData == NULL \|\|		effect_param_t p = (effect_param_t )pCmdData;
	cmdSize < (int)sizeof(effect_param_t) \|\|
	pReplyData == NULL \|\|		if (pCmdData == NULL \|\| cmdSize < sizeof(effect_param_t) \|\|
	*replySize < (int)sizeof(effect_param_t)){		cmdSize < (sizeof(effect_param_t) + p->psize) \|\|
			pReplyData == NULL \|\| replySize == NULL \|\|
			*replySize < (sizeof(effect_param_t) + p->psize)){
	ALOGV("PreProcessingFx_Command cmdCode Case: "		ALOGV("PreProcessingFx_Command cmdCode Case: "
	"EFFECT_CMD_GET_PARAM: ERROR");		"EFFECT_CMD_GET_PARAM: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	effect_param_t p = (effect_param_t )pCmdData;

	memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);		memcpy(pReplyData, pCmdData, sizeof(effect_param_t) + p->psize);

	@@ -1461,8 +1464,8 @@ int PreProcessingFx_Command(effect_handle_t self,

	case EFFECT_CMD_SET_PARAM:{		case EFFECT_CMD_SET_PARAM:{
	if (pCmdData == NULL\|\|		if (pCmdData == NULL\|\|
	cmdSize < (int)sizeof(effect_param_t) \|\|		cmdSize < sizeof(effect_param_t) \|\|
	pReplyData == NULL \|\|		pReplyData == NULL \|\| replySize == NULL \|\|
	*replySize != sizeof(int32_t)){		*replySize != sizeof(int32_t)){
	ALOGV("PreProcessingFx_Command cmdCode Case: "		ALOGV("PreProcessingFx_Command cmdCode Case: "
	"EFFECT_CMD_SET_PARAM: ERROR");		"EFFECT_CMD_SET_PARAM: ERROR");
	@@ -1483,7 +1486,7 @@ int PreProcessingFx_Command(effect_handle_t self,
	} break;		} break;

	case EFFECT_CMD_ENABLE:		case EFFECT_CMD_ENABLE:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)){		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)){
	ALOGV("PreProcessingFx_Command cmdCode Case: EFFECT_CMD_ENABLE: ERROR");		ALOGV("PreProcessingFx_Command cmdCode Case: EFFECT_CMD_ENABLE: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -1491,7 +1494,7 @@ int PreProcessingFx_Command(effect_handle_t self,
	break;		break;

	case EFFECT_CMD_DISABLE:		case EFFECT_CMD_DISABLE:
	if (pReplyData == NULL \|\| *replySize != sizeof(int)){		if (pReplyData == NULL \|\| replySize == NULL \|\| *replySize != sizeof(int)){
	ALOGV("PreProcessingFx_Command cmdCode Case: EFFECT_CMD_DISABLE: ERROR");		ALOGV("PreProcessingFx_Command cmdCode Case: EFFECT_CMD_DISABLE: ERROR");
	return -EINVAL;		return -EINVAL;
	}		}
	@@ -1711,7 +1714,7 @@ int PreProcessingFx_GetDescriptor(effect_handle_t self,

	int PreProcessingFx_ProcessReverse(effect_handle_t self,		int PreProcessingFx_ProcessReverse(effect_handle_t self,
	audio_buffer_t *inBuffer,		audio_buffer_t *inBuffer,
	audio_buffer_t *outBuffer)		audio_buffer_t *outBuffer __unused)
	{		{
	preproc_effect_t * effect = (preproc_effect_t *)self;		preproc_effect_t * effect = (preproc_effect_t *)self;
	int status = 0;		int status = 0;