commit d34a9dfc5ec334a06d1791d359c2aa5ba810a825
author Andy Hung <hunga@google.com> Tue Jun 21 17:47:03 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jun 21 17:47:03 2016 +0000
tree 856d7a7b625973b25453be2f1a57a62e7418a9dd
parent f9b986afc2ff20e8838d0deba56ad4d76f37775f
parent 1e1b7e4c3d513ea947b79fe9d0d4cf9a8e1242a3

Check effect command reply size in AudioFlinger am: 110bc9547a am: 075c8f7713 am: c971a59f4c am: 195f7c6125
am: 1e1b7e4c3d

Change-Id: I6558d45c768225007c53016542459cec3dd1387f

services/audioflinger/Effects.cpp

diff --git a/services/audioflinger/Effects.cpp b/services/audioflinger/Effects.cpp
index bcaf8ae..bcf06f8 100644
--- a/services/audioflinger/Effects.cpp
+++ b/services/audioflinger/Effects.cpp
@@ -550,6 +550,12 @@
     if (mStatus != NO_ERROR) {
         return mStatus;
     }
+    if (cmdCode == EFFECT_CMD_GET_PARAM &&
+            (*replySize < sizeof(effect_param_t) ||
+                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t))) {
+        android_errorWriteLog(0x534e4554, "29251553");
+        return -EINVAL;
+    }
     status_t status = (*mEffectInterface)->command(mEffectInterface,
                                                    cmdCode,
                                                    cmdSize,