diff options
| author | rago <rago@google.com> | 2016-11-22 18:02:48 -0800 |
|---|---|---|
| committer | Brinly Taylor <brinly@brinly.me> | 2017-03-13 04:55:12 +0000 |
| commit | 0574c56e88e96d33c923a8f54364ac0bf3dc5a91 (patch) | |
| tree | dd18959891e4b467a6d860d3b4e3238e3be6ea69 /services | |
| parent | 7900d8611ea22ce04c1697a8f391b83ed48c904d (diff) | |
| download | frameworks_av-0574c56e88e96d33c923a8f54364ac0bf3dc5a91.zip frameworks_av-0574c56e88e96d33c923a8f54364ac0bf3dc5a91.tar.gz frameworks_av-0574c56e88e96d33c923a8f54364ac0bf3dc5a91.tar.bz2 | |
Fix security vulnerability: potential OOB write in audioserver
Bug: 32705438
Bug: 32703959
Test: cts security test
Change-Id: I8900c92fa55b56c4c2c9d721efdbabe6bfc8a4a4
(cherry picked from commit e275907e576601a3579747c3a842790bacf111e2)
(cherry picked from commit b0bcddb44d992e74140a3f5eedc7177977ea8e34)
Diffstat (limited to 'services')
| -rw-r--r-- | services/audioflinger/Effects.cpp | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/services/audioflinger/Effects.cpp b/services/audioflinger/Effects.cpp index 27dfa05..b9fe741 100644 --- a/services/audioflinger/Effects.cpp +++ b/services/audioflinger/Effects.cpp @@ -578,6 +578,22 @@ status_t AudioFlinger::EffectModule::command(uint32_t cmdCode, android_errorWriteLog(0x534e4554, "32438594"); return -EINVAL; } + if (cmdCode == EFFECT_CMD_GET_PARAM && + (sizeof(effect_param_t) > *replySize + || ((effect_param_t *)pCmdData)->psize > *replySize + - sizeof(effect_param_t) + || ((effect_param_t *)pCmdData)->vsize > *replySize + - sizeof(effect_param_t) + - ((effect_param_t *)pCmdData)->psize + || roundUpDelta(((effect_param_t *)pCmdData)->psize, (uint32_t)sizeof(int)) > + *replySize + - sizeof(effect_param_t) + - ((effect_param_t *)pCmdData)->psize + - ((effect_param_t *)pCmdData)->vsize)) { + ALOGV("\tLVM_ERROR : EFFECT_CMD_GET_PARAM: reply size inconsistent"); + android_errorWriteLog(0x534e4554, "32705438"); + return -EINVAL; + } if ((cmdCode == EFFECT_CMD_SET_PARAM || cmdCode == EFFECT_CMD_SET_PARAM_DEFERRED) && // DEFERRED not generally used (sizeof(effect_param_t) > cmdSize |