Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e29e934c authored by Andy Hung's avatar Andy Hung Committed by Android (Google) Code Review
Browse files

Merge "DO NOT MERGE Fix AudioEffect reply overflow" into mnc-dev

parents 443de3f2 57fd9637

post_proc/bundle.c

+3 −2
Original line number Diff line number Diff line
@@ -621,8 +621,9 @@ int effect_command(effect_handle_t self, uint32_t cmdCode, uint32_t cmdSize, 
        if (pCmdData == NULL ||

            cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||

            pReplyData == NULL ||

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +

                               sizeof(uint16_t))) {

            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||

            // constrain memcpy below

            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

            status = -EINVAL;

            ALOGV("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",

                  cmdSize, *replySize);

voice_processing/voice_processing.c

+3 −1
Original line number Diff line number Diff line
@@ -560,7 +560,9 @@ static int fx_command(effect_handle_t self, 
            if (pCmdData == NULL ||

                    cmdSize < (int)sizeof(effect_param_t) ||

                    pReplyData == NULL ||

                    *replySize < (int)sizeof(effect_param_t)) {

                    *replySize < (int)sizeof(effect_param_t) ||

                    // constrain memcpy below

                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {

                ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");

                return -EINVAL;

            }