Merge "Check newAudioUniqueId() parameter 'use'" into nyc-dev (dd3e7a1b) · Commits · e / os / android_frameworks_av

services/audioflinger/AudioFlinger.cpp

+7 −0

Original line number	Diff line number	Diff line
		@@ -2258,6 +2258,12 @@ status_t AudioFlinger::invalidateStream(audio_stream_type_t stream)

		audio_unique_id_t AudioFlinger::newAudioUniqueId(audio_unique_id_use_t use)
		{
		// This is a binder API, so a malicious client could pass in a bad parameter.
		// Check for that before calling the internal API nextUniqueId().
		if ((unsigned) use >= (unsigned) AUDIO_UNIQUE_ID_USE_MAX) {
		ALOGE("newAudioUniqueId invalid use %d", use);
		return AUDIO_UNIQUE_ID_ALLOCATE;
		}
		return nextUniqueId(use);
		}

		@@ -2421,6 +2427,7 @@ audio_unique_id_t AudioFlinger::nextUniqueId(audio_unique_id_use_t use)
		int32_t base = android_atomic_add(AUDIO_UNIQUE_ID_USE_MAX, &mNextUniqueId);
		// We have no way of recovering from wraparound
		LOG_ALWAYS_FATAL_IF(base == 0, "unique ID overflow");
		// This is the internal API, so it is OK to assert on bad parameter.
		LOG_ALWAYS_FATAL_IF((unsigned) use >= (unsigned) AUDIO_UNIQUE_ID_USE_MAX);
		ALOG_ASSERT(audio_unique_id_get_use(base) == AUDIO_UNIQUE_ID_USE_UNSPECIFIED);
		return (audio_unique_id_t) (base \| use);

+2 −0

Original line number	Diff line number	Diff line
		@@ -196,6 +196,7 @@ public:

		virtual uint32_t getInputFramesLost(audio_io_handle_t ioHandle) const;

		// This is the binder API. For the internal API see nextUniqueId().
		virtual audio_unique_id_t newAudioUniqueId(audio_unique_id_use_t use);

		virtual void acquireAudioSessionId(audio_session_t audioSession, pid_t pid);
		@@ -559,6 +560,7 @@ private:
		// or from positive to negative (for signed IDs).
		// Thus it may fail by returning an ID of the wrong sign,
		// or by returning a non-unique ID.
		// This is the internal API. For the binder API see newAudioUniqueId().
		audio_unique_id_t nextUniqueId(audio_unique_id_use_t use);

		status_t moveEffectChain_l(audio_session_t sessionId,