Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 377e999d authored by jiabin's avatar jiabin Committed by Presubmit Automerger Backend
Browse files

[automerge] Fix array out of bound in audioTransportToHal. 2p: f16c6d3a 

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/19214732

Bug: 237288416
Bug: 237717857
Change-Id: I266f57c1dc80b3787ce1f9c40c82d8daaff6b9e4
Merged-In: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9
parents 6adbab13 f16c6d3a

audio/common/all-versions/default/7.0/HidlUtils.cpp

+3 −2
Original line number Diff line number Diff line
@@ -894,7 +894,7 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo 
    for (const auto& transport : transports) {

        switch (transport.audioCapability.getDiscriminator()) {

            case AudioTransport::AudioCapability::hidl_discriminator::profile:

                if (halPort->num_audio_profiles > AUDIO_PORT_MAX_AUDIO_PROFILES) {

                if (halPort->num_audio_profiles >= AUDIO_PORT_MAX_AUDIO_PROFILES) {

                    ALOGE("%s, too many audio profiles", __func__);

                    result = BAD_VALUE;

                    break;
@@ -910,7 +910,8 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo 
                                result);

                break;

            case AudioTransport::AudioCapability::hidl_discriminator::edid:

                if (halPort->num_extra_audio_descriptors > AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {

                if (halPort->num_extra_audio_descriptors >=

                    AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {

                    ALOGE("%s, too many extra audio descriptors", __func__);

                    result = BAD_VALUE;

                    break;

audio/common/all-versions/default/tests/hidlutils_tests.cpp

+33 −9
Original line number Diff line number Diff line
@@ -954,6 +954,18 @@ TEST(HidlUtils, ConvertAudioPortConfig) { 
    EXPECT_TRUE(audio_port_configs_are_equal(&halConfig, &halConfigBack));

}



static AudioProfile generateValidAudioProfile() {

    AudioProfile profile;

    profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);

    profile.sampleRates.resize(2);

    profile.sampleRates[0] = 44100;

    profile.sampleRates[1] = 48000;

    profile.channelMasks.resize(2);

    profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);

    profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);

    return profile;

}



TEST(HidlUtils, ConvertInvalidAudioTransports) {

    hidl_vec<AudioTransport> invalid;

    struct audio_port_v7 halInvalid = {};
@@ -973,20 +985,32 @@ TEST(HidlUtils, ConvertInvalidAudioTransports) { 
    invalid[0].audioCapability.edid(hidl_vec<uint8_t>(EXTRA_AUDIO_DESCRIPTOR_SIZE + 1));

    invalid[1].encapsulationType = "random string";

    EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));



    // The size of audio profile must not be greater than the maximum value.

    invalid.resize(0);

    invalid.resize(AUDIO_PORT_MAX_AUDIO_PROFILES + 1);

    for (size_t i = 0; i < invalid.size(); ++i) {

        invalid[i].audioCapability.profile(generateValidAudioProfile());

        invalid[i].encapsulationType =

                toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);

    }

    EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));



    // The size of extra audio descriptors must not be greater than the maximum value.

    invalid.resize(0);

    invalid.resize(AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS + 1);

    for (size_t i = 0; i < invalid.size(); ++i) {

        invalid[i].audioCapability.edid({0x11, 0x06, 0x01});

        invalid[i].encapsulationType =

                toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_IEC61937);

    }

    EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));

}



TEST(HidlUtils, ConvertAudioTransports) {

    hidl_vec<AudioTransport> transports;

    transports.resize(2);

    AudioProfile profile;

    profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);

    profile.sampleRates.resize(2);

    profile.sampleRates[0] = 44100;

    profile.sampleRates[1] = 48000;

    profile.channelMasks.resize(2);

    profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);

    profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);

    transports[0].audioCapability.profile(profile);

    transports[0].audioCapability.profile(generateValidAudioProfile());

    hidl_vec<uint8_t> shortAudioDescriptor({0x11, 0x06, 0x01});

    transports[0].encapsulationType =

            toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);