commit 34f29aac0400290f98d42a3d807b2b8d6e8bd4e6
author Andy Hung <hunga@google.com> Thu Nov 10 20:18:48 2016 +0000
committer android-build-merger <android-build-merger@google.com> Thu Nov 10 20:18:48 2016 +0000
tree 69088e2ff253432dec7a84db76b35327243bc633
parent bc30f3a764d8019e06280271676b5f1dad7d0575
parent 8c8eb964c09435a4834dedcba248c4a0944653ba

Effects: Check get parameter command size am: 3d34cc76e3 am: 59920bf785 am: 14d87911d7 am: 79a088a065 am: 58e5681c96 am: f0f864a1e4 am: 134e208477 am: 5662efe76b am: 1ad93b9617
am: 8c8eb964c0

Change-Id: If5f09a4ad11bc1045e8a961091cfaa90ff554237

services/audioflinger/Effects.cpp

diff --git a/services/audioflinger/Effects.cpp b/services/audioflinger/Effects.cpp
index 28a14f7..e351b8d 100644
--- a/services/audioflinger/Effects.cpp
+++ b/services/audioflinger/Effects.cpp
@@ -571,6 +571,13 @@
         android_errorWriteLog(0x534e4554, "29251553");
         return -EINVAL;
     }
+    if (cmdCode == EFFECT_CMD_GET_PARAM &&
+            (sizeof(effect_param_t) > cmdSize ||
+                    ((effect_param_t *)pCmdData)->psize > cmdSize
+                                                          - sizeof(effect_param_t))) {
+        android_errorWriteLog(0x534e4554, "32438594");
+        return -EINVAL;
+    }
     if ((cmdCode == EFFECT_CMD_SET_PARAM
             || cmdCode == EFFECT_CMD_SET_PARAM_DEFERRED) &&  // DEFERRED not generally used
         (sizeof(effect_param_t) > cmdSize