diff options
Diffstat (limited to 'services')
| -rw-r--r-- | services/audioflinger/Effects.cpp | 7 | ||||
| -rw-r--r-- | services/soundtrigger/SoundTriggerHwService.cpp | 2 |
2 files changed, 8 insertions, 1 deletions
diff --git a/services/audioflinger/Effects.cpp b/services/audioflinger/Effects.cpp index 5505d2e..d46c10e 100644 --- a/services/audioflinger/Effects.cpp +++ b/services/audioflinger/Effects.cpp @@ -571,6 +571,13 @@ status_t AudioFlinger::EffectModule::command(uint32_t cmdCode, android_errorWriteLog(0x534e4554, "29251553"); return -EINVAL; } + if (cmdCode == EFFECT_CMD_GET_PARAM && + (sizeof(effect_param_t) > cmdSize || + ((effect_param_t *)pCmdData)->psize > cmdSize + - sizeof(effect_param_t))) { + android_errorWriteLog(0x534e4554, "32438594"); + return -EINVAL; + } if ((cmdCode == EFFECT_CMD_SET_PARAM || cmdCode == EFFECT_CMD_SET_PARAM_DEFERRED) && // DEFERRED not generally used (sizeof(effect_param_t) > cmdSize diff --git a/services/soundtrigger/SoundTriggerHwService.cpp b/services/soundtrigger/SoundTriggerHwService.cpp index a1cc6ff..a45d5f6 100644 --- a/services/soundtrigger/SoundTriggerHwService.cpp +++ b/services/soundtrigger/SoundTriggerHwService.cpp @@ -270,12 +270,12 @@ void SoundTriggerHwService::sendRecognitionEvent(struct sound_trigger_recognitio if (module == NULL) { return; } + struct sound_trigger_phrase_recognition_event newEvent; if (event-> type == SOUND_MODEL_TYPE_KEYPHRASE && event->data_size != 0 && event->data_offset != sizeof(struct sound_trigger_phrase_recognition_event)) { // set some defaults for the phrase if the recognition event won't be parsed properly // TODO: read defaults from the config - struct sound_trigger_phrase_recognition_event newEvent; memset(&newEvent, 0, sizeof(struct sound_trigger_phrase_recognition_event)); sp<Model> model = module->getModel(event->model); |