Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4881f84 authored by rago's avatar rago Committed by android-build-merger
Browse files

Fix security vulnerability: Effect command might allow negative indexes am:... 

Fix security vulnerability: Effect command might allow negative indexes am: 01183402 am: 94e3424b
am: 9bf3487e

Change-Id: Ia36571a591829777096ad41316b7edf169ce9a6c
parents c236ae3a 9bf3487e

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+11 −3
Original line number Original line Diff line number Diff line
@@ -2351,9 +2351,13 @@ int Equalizer_getParameter(EffectContext *pContext, 




    case EQ_PARAM_GET_PRESET_NAME:

    case EQ_PARAM_GET_PRESET_NAME:

        param2 = *pParamTemp;

        param2 = *pParamTemp;

        if (param2 >= EqualizerGetNumPresets()) {

        if ((param2 < 0 && param2 != PRESET_CUSTOM) ||  param2 >= EqualizerGetNumPresets()) {

        //if (param2 >= 20) {     // AGO FIX

            status = -EINVAL;

            status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32448258");

                ALOGE("\tERROR Equalizer_getParameter() EQ_PARAM_GET_PRESET_NAME preset %d",

                        param2);

            }

            break;

            break;

        }

        }

        name = (char *)pValue;

        name = (char *)pValue;
@@ -2423,8 +2427,12 @@ int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue) 
        band =  *pParamTemp;

        band =  *pParamTemp;

        level = (int32_t)(*(int16_t *)pValue);

        level = (int32_t)(*(int16_t *)pValue);

        //ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);

        //ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);

        if (band >= FIVEBAND_NUMBANDS) {

        if (band < 0 || band >= FIVEBAND_NUMBANDS) {

            status = -EINVAL;

            status = -EINVAL;

            if (band < 0) {

                android_errorWriteLog(0x534e4554, "32095626");

                ALOGE("\tERROR Equalizer_setParameter() EQ_PARAM_BAND_LEVEL band %d", band);

            }

            break;

            break;

        }

        }

        EqualizerSetBandLevel(pContext, band, level);

        EqualizerSetBandLevel(pContext, band, level);