Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 540acb3d authored by Andy Hung's avatar Andy Hung Committed by Android (Google) Code Review
Browse files

Merge "DO NOT MERGE Fix AudioEffect reply overflow" into lmp-dev

parents 11018b82 94587af5

post_proc/bundle.c

+3 −2
Original line number Diff line number Diff line
@@ -620,8 +620,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, 
        if (pCmdData == NULL ||

            cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||

            pReplyData == NULL ||

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +

                               sizeof(uint16_t))) {

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||

            // constrain memcpy below

            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

            status = -EINVAL;

            ALOGV("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",

                  cmdSize, *replySize);

voice_processing/voice_processing.c

+3 −1
Original line number Diff line number Diff line
@@ -559,7 +559,9 @@ static int fx_command(effect_handle_t self, 
            if (pCmdData == NULL ||

                    cmdSize < (int)sizeof(effect_param_t) ||

                    pReplyData == NULL ||

                    *replySize < (int)sizeof(effect_param_t)) {

                    *replySize < (int)sizeof(effect_param_t) ||

                    // constrain memcpy below

                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

                ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");

                return -EINVAL;

            }