summaryrefslogtreecommitdiffstats
path: root/media/libmedia/IEffect.cpp
diff options
context:
space:
mode:
authorWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2017-05-02 19:21:00 +0200
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2017-05-02 19:21:00 +0200
commiteca582052ef000897f69d6d0bdd96c7a8aa59cda (patch)
tree7472d8773c4bb9321fdd41d0aef057e30045e557 /media/libmedia/IEffect.cpp
parent26718276fd99ef60d9646d79467d2bb3f2db5549 (diff)
parentdc7805b0c79d056385a076422894425984af2aa0 (diff)
downloadframeworks_av-eca582052ef000897f69d6d0bdd96c7a8aa59cda.zip
frameworks_av-eca582052ef000897f69d6d0bdd96c7a8aa59cda.tar.gz
frameworks_av-eca582052ef000897f69d6d0bdd96c7a8aa59cda.tar.bz2
Merge branch 'cm-13.0' of https://github.com/LineageOS/android_frameworks_av into replicant-6.0HEADreplicant-6.0-0001replicant-6.0
Diffstat (limited to 'media/libmedia/IEffect.cpp')
-rw-r--r--media/libmedia/IEffect.cpp12
1 files changed, 12 insertions, 0 deletions
diff --git a/media/libmedia/IEffect.cpp b/media/libmedia/IEffect.cpp
index faf5795..af6d8de 100644
--- a/media/libmedia/IEffect.cpp
+++ b/media/libmedia/IEffect.cpp
@@ -25,6 +25,9 @@
namespace android {
+// Maximum command/reply size expected
+#define EFFECT_PARAM_SIZE_MAX 65536
+
enum {
ENABLE = IBinder::FIRST_CALL_TRANSACTION,
DISABLE,
@@ -156,6 +159,10 @@ status_t BnEffect::onTransact(
uint32_t cmdSize = data.readInt32();
char *cmd = NULL;
if (cmdSize) {
+ if (cmdSize > EFFECT_PARAM_SIZE_MAX) {
+ reply->writeInt32(NO_MEMORY);
+ return NO_ERROR;
+ }
cmd = (char *)calloc(cmdSize, 1);
if (cmd == NULL) {
reply->writeInt32(NO_MEMORY);
@@ -167,6 +174,11 @@ status_t BnEffect::onTransact(
uint32_t replySz = replySize;
char *resp = NULL;
if (replySize) {
+ if (replySize > EFFECT_PARAM_SIZE_MAX) {
+ free(cmd);
+ reply->writeInt32(NO_MEMORY);
+ return NO_ERROR;
+ }
resp = (char *)calloc(replySize, 1);
if (resp == NULL) {
free(cmd);