commit c4a8f513873da6075a5f9d8d806ec395cbde0bf8
author Kevin Rocard <krocard@google.com> Mon Dec 04 18:18:34 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Dec 04 18:18:34 2017 +0000
tree c534384cd1b4dbda07217753c2c2ca9193a6906c
parent 560028c73636f1e8c2ce41dad0c3ba555bad1d3b
parent 196094537bba7e9bb555ac1da293cf849a8d8a58

Merge "IAudioPolicyService: Add attribute tags sanitization" into mnc-dev am: f9131eab02 am: 4c30b6b2b8 am: f3c6fcc9ea am: 0ca72f6f22
am: 196094537b

Change-Id: I2ff701d7da0971286656b653697d57661e1496b8

include/media/IAudioPolicyService.h

diff --git a/include/media/IAudioPolicyService.h b/include/media/IAudioPolicyService.h
index 0e9e3bc..de6e5ce 100644
--- a/include/media/IAudioPolicyService.h
+++ b/include/media/IAudioPolicyService.h
@@ -181,6 +181,8 @@
                                     const Parcel& data,
                                     Parcel* reply,
                                     uint32_t flags = 0);
+private:
+    void sanetizeAudioAttributes(audio_attributes_t* attr);
 };
 
 // ----------------------------------------------------------------------------

media/libmedia/IAudioPolicyService.cpp

diff --git a/media/libmedia/IAudioPolicyService.cpp b/media/libmedia/IAudioPolicyService.cpp
index 6405d6d..294b8f6 100644
--- a/media/libmedia/IAudioPolicyService.cpp
+++ b/media/libmedia/IAudioPolicyService.cpp
@@ -893,6 +893,7 @@
             bool hasAttributes = data.readInt32() != 0;
             if (hasAttributes) {
                 data.read(&attr, sizeof(audio_attributes_t));
+                sanetizeAudioAttributes(&attr);
             }
             audio_session_t session = (audio_session_t)data.readInt32();
             audio_stream_type_t stream = AUDIO_STREAM_DEFAULT;
@@ -960,6 +961,7 @@
             CHECK_INTERFACE(IAudioPolicyService, data, reply);
             audio_attributes_t attr;
             data.read(&attr, sizeof(audio_attributes_t));
+            sanetizeAudioAttributes(&attr);
             audio_session_t session = (audio_session_t)data.readInt32();
             pid_t pid = (pid_t)data.readInt32();
             uid_t uid = (uid_t)data.readInt32();
@@ -1332,6 +1334,7 @@
             data.read(&source, sizeof(struct audio_port_config));
             audio_attributes_t attributes;
             data.read(&attributes, sizeof(audio_attributes_t));
+            sanetizeAudioAttributes(&attributes);
             audio_io_handle_t handle = {};
             status_t status = startAudioSource(&source, &attributes, &handle);
             reply->writeInt32(status);
@@ -1371,6 +1374,15 @@
     }
 }
 
+void BnAudioPolicyService::sanetizeAudioAttributes(audio_attributes_t* attr)
+{
+    const size_t tagsMaxSize = AUDIO_ATTRIBUTES_TAGS_MAX_SIZE;
+    if (strnlen(attr->tags, tagsMaxSize) >= tagsMaxSize) {
+        android_errorWriteLog(0x534e4554, "68953950"); // SafetyNet logging
+    }
+    attr->tags[tagsMaxSize - 1] = '\0';
+}
+
 // ----------------------------------------------------------------------------
 
 } // namespace android