commit 0dac1009bbcae3b4b2fc352e738358e7e76b0a54
author Andy Hung <hunga@google.com> Tue May 03 23:27:44 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue May 03 23:27:44 2016 +0000
tree 391f2d89d5e741b950e242c0b7fe8093fa28b0f6
parent 34fa769ab5835cefb9a6b842590f5f690c0a52db
parent 7ffa39c45458a3e39210304ef8f5173b52ba486a

DO NOT MERGE Fix AudioEffect reply overflow
am: 7ffa39c454

* commit '7ffa39c45458a3e39210304ef8f5173b52ba486a':
  DO NOT MERGE Fix AudioEffect reply overflow

Change-Id: Ia43f0a917f458b1647000fa2e167af09c486139a

voice_processing/voice_processing.c

diff --git a/voice_processing/voice_processing.c b/voice_processing/voice_processing.c
index b8b1e1b..9543f96 100644
--- a/voice_processing/voice_processing.c
+++ b/voice_processing/voice_processing.c
@@ -559,7 +559,9 @@
             if (pCmdData == NULL ||
                     cmdSize < (int)sizeof(effect_param_t) ||
                     pReplyData == NULL ||
-                    *replySize < (int)sizeof(effect_param_t)) {
+                    *replySize < (int)sizeof(effect_param_t) ||
+                    // constrain memcpy below
+                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {
                 ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");
                 return -EINVAL;
             }