Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df81fc3f authored by Eric Laurent's avatar Eric Laurent Committed by android-build-merger
Browse files

fix possible overflow in effect wrappers. am: 9e29523b am: baebc739 am: 3a9d4f4a 

am: 5b7c20dd

* commit '5b7c20dd':
  fix possible overflow in effect wrappers.
parents 50270d98 5b7c20dd

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+4 −1
Original line number Diff line number Diff line
@@ -3053,7 +3053,10 @@ int Effect_command(effect_handle_t self, 
            //ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM start");



            effect_param_t *p = (effect_param_t *)pCmdData;



            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {

                android_errorWriteLog(0x534e4554, "26347509");

                return -EINVAL;

            }

            if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||

                    cmdSize < (sizeof(effect_param_t) + p->psize) ||

                    pReplyData == NULL || replySize == NULL ||

media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp

+4 −1
Original line number Diff line number Diff line
@@ -1956,7 +1956,10 @@ int Reverb_command(effect_handle_t self, 
            //ALOGV("\tReverb_command cmdCode Case: "

            //        "EFFECT_CMD_GET_PARAM start");

            effect_param_t *p = (effect_param_t *)pCmdData;



            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {

                android_errorWriteLog(0x534e4554, "26347509");

                return -EINVAL;

            }

            if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||

                    cmdSize < (sizeof(effect_param_t) + p->psize) ||

                    pReplyData == NULL || replySize == NULL ||