Merge "Fixed possible heap corruption in EffectDesc" (df344b6f) · Commits · e / os / android_frameworks_base

services/audioflinger/AudioPolicyService.cpp

+3 −19

Original line number	Original line	Diff line number	Diff line
	@@ -116,19 +116,7 @@ AudioPolicyService::~AudioPolicyService()

	// release audio pre processing resources		// release audio pre processing resources
	for (size_t i = 0; i < mInputSources.size(); i++) {		for (size_t i = 0; i < mInputSources.size(); i++) {
	InputSourceDesc *source = mInputSources.valueAt(i);		delete mInputSources.valueAt(i);
	Vector <EffectDesc *> effects = source->mEffects;
	for (size_t j = 0; j < effects.size(); j++) {
	delete effects[j]->mName;
	Vector <effect_param_t *> params = effects[j]->mParams;
	for (size_t k = 0; k < params.size(); k++) {
	delete params[k];
	}
	params.clear();
	delete effects[j];
	}
	effects.clear();
	delete source;
	}		}
	mInputSources.clear();		mInputSources.clear();

	@@ -1243,7 +1231,7 @@ AudioPolicyService::InputSourceDesc *AudioPolicyService::loadInputSource(
	node = node->next;		node = node->next;
	continue;		continue;
	}		}
	EffectDesc effect = new EffectDesc(effects[i]);		EffectDesc effect = new EffectDesc(effects[i]); // deep copy
	loadEffectParameters(node, effect->mParams);		loadEffectParameters(node, effect->mParams);
	ALOGV("loadInputSource() adding effect %s uuid %08x", effect->mName, effect->mUuid.timeLow);		ALOGV("loadInputSource() adding effect %s uuid %08x", effect->mName, effect->mUuid.timeLow);
	source->mEffects.add(effect);		source->mEffects.add(effect);
	@@ -1294,11 +1282,7 @@ AudioPolicyService::EffectDesc AudioPolicyService::loadEffect(cnode root)
	ALOGW("loadEffect() invalid uuid %s", node->value);		ALOGW("loadEffect() invalid uuid %s", node->value);
	return NULL;		return NULL;
	}		}
	EffectDesc *effect = new EffectDesc();		return new EffectDesc(root->name, uuid);
	effect->mName = strdup(root->name);
	memcpy(&effect->mUuid, &uuid, sizeof(effect_uuid_t));

	return effect;
	}		}

	status_t AudioPolicyService::loadEffects(cnode root, Vector <EffectDesc >& effects)		status_t AudioPolicyService::loadEffects(cnode root, Vector <EffectDesc >& effects)

services/audioflinger/AudioPolicyService.h

+32 −3

Original line number	Original line	Diff line number	Diff line
	@@ -233,8 +233,33 @@ private:

	class EffectDesc {		class EffectDesc {
	public:		public:
	EffectDesc() {}		EffectDesc(const char *name, const effect_uuid_t& uuid) :
	virtual ~EffectDesc() {}		mName(strdup(name)),
			mUuid(uuid) { }
			EffectDesc(const EffectDesc& orig) :
			mName(strdup(orig.mName)),
			mUuid(orig.mUuid) {
			// deep copy mParams
			for (size_t k = 0; k < orig.mParams.size(); k++) {
			effect_param_t *origParam = orig.mParams[k];
			// psize and vsize are rounded up to an int boundary for allocation
			size_t origSize = sizeof(effect_param_t) +
			((origParam->psize + 3) & ~3) +
			((origParam->vsize + 3) & ~3);
			effect_param_t dupParam = (effect_param_t ) malloc(origSize);
			memcpy(dupParam, origParam, origSize);
			// This works because the param buffer allocation is also done by
			// multiples of 4 bytes originally. In theory we should memcpy only
			// the actual param size, that is without rounding vsize.
			mParams.add(dupParam);
			}
			}
			/virtual/ ~EffectDesc() {
			free(mName);
			for (size_t k = 0; k < mParams.size(); k++) {
			free(mParams[k]);
			}
			}
	char *mName;		char *mName;
	effect_uuid_t mUuid;		effect_uuid_t mUuid;
	Vector <effect_param_t *> mParams;		Vector <effect_param_t *> mParams;
	@@ -243,7 +268,11 @@ private:
	class InputSourceDesc {		class InputSourceDesc {
	public:		public:
	InputSourceDesc() {}		InputSourceDesc() {}
	virtual ~InputSourceDesc() {}		/virtual/ ~InputSourceDesc() {
			for (size_t j = 0; j < mEffects.size(); j++) {
			delete mEffects[j];
			}
			}
	Vector <EffectDesc *> mEffects;		Vector <EffectDesc *> mEffects;
	};		};