Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 716d65bc authored by rago's avatar rago Committed by android-build-merger
Browse files

Fix security vulnerability: Equalizer command might allow negative indexes am:... 

Fix security vulnerability: Equalizer command might allow negative indexes am: ceb7b2d7 am: f7d23525 am: e25cc478 am: 41c5a018 am: 1e31fc2f am: f436af62 am: 93f5e649
am: ca11e5d6

Change-Id: I917e2d914de5ffe95edd4842064d3db0fb26d788
parents 6ae40159 ca11e5d6

post_proc/equalizer.c

+16 −4
Original line number Diff line number Diff line
@@ -265,8 +265,12 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, 
    case EQ_PARAM_BAND_LEVEL:

	ALOGV("%s: EQ_PARAM_BAND_LEVEL", __func__);

        param2 = *param_tmp;

        if (param2 >= NUM_EQ_BANDS) {

        if (param2 < 0 || param2 >= NUM_EQ_BANDS) {

            p->status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32438598");

                ALOGW("\tERROR EQ_PARAM_BAND_LEVEL band %d", param2);

            }

            break;

        }

        *(int16_t *)value = (int16_t)equalizer_get_band_level(eq_ctxt, param2);
@@ -275,8 +279,12 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, 
    case EQ_PARAM_CENTER_FREQ:

	ALOGV("%s: EQ_PARAM_CENTER_FREQ", __func__);

        param2 = *param_tmp;

        if (param2 >= NUM_EQ_BANDS) {

        if (param2 < 0 || param2 >= NUM_EQ_BANDS) {

            p->status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32436341");

                ALOGW("\tERROR EQ_PARAM_CENTER_FREQ band %d", param2);

            }

            break;

        }

        *(int32_t *)value = equalizer_get_center_frequency(eq_ctxt, param2);
@@ -285,8 +293,12 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, 
    case EQ_PARAM_BAND_FREQ_RANGE:

	ALOGV("%s: EQ_PARAM_BAND_FREQ_RANGE", __func__);

        param2 = *param_tmp;

        if (param2 >= NUM_EQ_BANDS) {

        if (param2 < 0 || param2 >= NUM_EQ_BANDS) {

            p->status = -EINVAL;

            if (param2 < 0) {

                android_errorWriteLog(0x534e4554, "32247948");

                ALOGW("\tERROR EQ_PARAM_BAND_FREQ_RANGE band %d", param2);

            }

           break;

        }

       equalizer_get_band_freq_range(eq_ctxt, param2, (uint32_t *)value,