Merge branch 'cm-13.0' of https://github.com/LineageOS/android_frameworks_av into replicant-6.0

2 files changed, 8 insertions, 1 deletions

diff --git a/services/audioflinger/Effects.cpp b/services/audioflinger/Effects.cpp
index 5505d2e..d46c10e 100644
--- a/services/audioflinger/Effects.cpp
+++ b/services/audioflinger/Effects.cpp
@@ -571,6 +571,13 @@ status_t AudioFlinger::EffectModule::command(uint32_t cmdCode,
         android_errorWriteLog(0x534e4554, "29251553");
         return -EINVAL;
     }
+    if (cmdCode == EFFECT_CMD_GET_PARAM &&
+            (sizeof(effect_param_t) > cmdSize ||
+                    ((effect_param_t *)pCmdData)->psize > cmdSize
+                                                          - sizeof(effect_param_t))) {
+        android_errorWriteLog(0x534e4554, "32438594");
+        return -EINVAL;
+    }
     if ((cmdCode == EFFECT_CMD_SET_PARAM
             || cmdCode == EFFECT_CMD_SET_PARAM_DEFERRED) &&  // DEFERRED not generally used
         (sizeof(effect_param_t) > cmdSize
diff --git a/services/soundtrigger/SoundTriggerHwService.cpp b/services/soundtrigger/SoundTriggerHwService.cpp
index a1cc6ff..a45d5f6 100644
--- a/services/soundtrigger/SoundTriggerHwService.cpp
+++ b/services/soundtrigger/SoundTriggerHwService.cpp
@@ -270,12 +270,12 @@ void SoundTriggerHwService::sendRecognitionEvent(struct sound_trigger_recognitio
      if (module == NULL) {
          return;
      }
+    struct sound_trigger_phrase_recognition_event newEvent;
     if (event-> type == SOUND_MODEL_TYPE_KEYPHRASE && event->data_size != 0
         && event->data_offset != sizeof(struct sound_trigger_phrase_recognition_event)) {
         // set some defaults for the phrase if the recognition event won't be parsed properly
         // TODO: read defaults from the config
 
-        struct sound_trigger_phrase_recognition_event newEvent;
         memset(&newEvent, 0, sizeof(struct sound_trigger_phrase_recognition_event));
 
         sp<Model> model = module->getModel(event->model);