diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2017-02-13 16:31:20 -0800 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-04-05 18:36:58 -0600 |
| commit | f2c6b991081806343e038a687c8d8f63a747abd7 (patch) | |
| tree | 57dabf68157f3d12841e2688a18c5ae85a0a24e3 | |
| parent | c59a656f9923a0e2fc308dabc373594e88b345d1 (diff) | |
| download | frameworks_av-f2c6b991081806343e038a687c8d8f63a747abd7.zip frameworks_av-f2c6b991081806343e038a687c8d8f63a747abd7.tar.gz frameworks_av-f2c6b991081806343e038a687c8d8f63a747abd7.tar.bz2 | |
EffectBundle: check nb channels to write speaker angles
When speaker angles are queried, the size of the array for the
returned data is 3x the number of channels (where really it
should be max(2, nbChannels)). The code assumed it was at
least 3x2 (where 2 is the number of virtual speakers this
effect supports) and would thus crash when called for a mono
channel mask.
Test: see repro steps in bug
Bug: 32591350
AOSP-Change-Id: I33d4bff6b2e19a9fc4284a85a446804878d3a410
CVE-2017-0545
Change-Id: Ie4480d9abcfafcd53fca15ab2fd8ef7ecb6fd48d
(cherry picked from commit e5a54485e08400a976092cd5b1c6d909d0e1a4ab)
| -rw-r--r-- | media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp index 2588140..9cddf6a 100644 --- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp +++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp @@ -1465,17 +1465,25 @@ int VirtualizerForceVirtualizationMode(EffectContext *pContext, audio_devices_t // horizontal plane, +90 is directly above the user, -90 below // //---------------------------------------------------------------------------- -void VirtualizerGetSpeakerAngles(audio_channel_mask_t channelMask __unused, +void VirtualizerGetSpeakerAngles(audio_channel_mask_t channelMask, audio_devices_t deviceType __unused, int32_t *pSpeakerAngles) { // the channel count is guaranteed to be 1 or 2 // the device is guaranteed to be of type headphone - // this virtualizer is always 2in with speakers at -90 and 90deg of azimuth, 0deg of elevation - *pSpeakerAngles++ = (int32_t) AUDIO_CHANNEL_OUT_FRONT_LEFT; - *pSpeakerAngles++ = -90; // azimuth - *pSpeakerAngles++ = 0; // elevation - *pSpeakerAngles++ = (int32_t) AUDIO_CHANNEL_OUT_FRONT_RIGHT; - *pSpeakerAngles++ = 90; // azimuth - *pSpeakerAngles = 0; // elevation + // this virtualizer is always using 2 virtual speakers at -90 and 90deg of azimuth, 0deg of + // elevation but the return information is sized for nbChannels * 3, so we have to consider + // the (false here) case of a single channel, and return only 3 fields. + if (audio_channel_count_from_out_mask(channelMask) == 1) { + *pSpeakerAngles++ = (int32_t) AUDIO_CHANNEL_OUT_MONO; // same as FRONT_LEFT + *pSpeakerAngles++ = 0; // azimuth + *pSpeakerAngles = 0; // elevation + } else { + *pSpeakerAngles++ = (int32_t) AUDIO_CHANNEL_OUT_FRONT_LEFT; + *pSpeakerAngles++ = -90; // azimuth + *pSpeakerAngles++ = 0; // elevation + *pSpeakerAngles++ = (int32_t) AUDIO_CHANNEL_OUT_FRONT_RIGHT; + *pSpeakerAngles++ = 90; // azimuth + *pSpeakerAngles = 0; // elevation + } } //---------------------------------------------------------------------------- |