diff options
| author | Eric Laurent <elaurent@google.com> | 2015-05-04 15:29:36 -0700 |
|---|---|---|
| committer | Eric Laurent <elaurent@google.com> | 2015-05-04 15:29:36 -0700 |
| commit | b9096dc829bd9ffd912f88853a87c972086c8796 (patch) | |
| tree | ddeaa7ddb01d54fd871e23c133c0bf3a45f4f2ba /soundtrigger | |
| parent | 32fa6d0e65dbf956e253a1006e9419dce2fe75c9 (diff) | |
| download | frameworks_av-b9096dc829bd9ffd912f88853a87c972086c8796.zip frameworks_av-b9096dc829bd9ffd912f88853a87c972086c8796.tar.gz frameworks_av-b9096dc829bd9ffd912f88853a87c972086c8796.tar.bz2 | |
Check memory allocation in ISoundTriggerHwService
Add memory allocation check in ISoundTriggerHwService::listModules().
Bug: 19385640.
Change-Id: Iaf74b6f154c3437e1bfc9da78b773d64b16a7604
Diffstat (limited to 'soundtrigger')
| -rw-r--r-- | soundtrigger/ISoundTriggerHwService.cpp | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/soundtrigger/ISoundTriggerHwService.cpp b/soundtrigger/ISoundTriggerHwService.cpp index 75f68b8..e14a771 100644 --- a/soundtrigger/ISoundTriggerHwService.cpp +++ b/soundtrigger/ISoundTriggerHwService.cpp @@ -40,6 +40,8 @@ enum { SET_CAPTURE_STATE, }; +#define MAX_ITEMS_PER_LIST 1024 + class BpSoundTriggerHwService: public BpInterface<ISoundTriggerHwService> { public: @@ -116,10 +118,18 @@ status_t BnSoundTriggerHwService::onTransact( case LIST_MODULES: { CHECK_INTERFACE(ISoundTriggerHwService, data, reply); unsigned int numModulesReq = data.readInt32(); + if (numModulesReq > MAX_ITEMS_PER_LIST) { + numModulesReq = MAX_ITEMS_PER_LIST; + } unsigned int numModules = numModulesReq; struct sound_trigger_module_descriptor *modules = (struct sound_trigger_module_descriptor *)calloc(numModulesReq, sizeof(struct sound_trigger_module_descriptor)); + if (modules == NULL) { + reply->writeInt32(NO_MEMORY); + reply->writeInt32(0); + return NO_ERROR; + } status_t status = listModules(modules, &numModules); reply->writeInt32(status); reply->writeInt32(numModules); |