commit 1513f9712dc7c73d12845628f159603c37620484
author Mingshu Pang <mpang@codeaurora.org> Fri May 24 12:43:51 2019 +0800
committer Weiyin Jiang <wjiang@codeaurora.org> Fri May 24 17:12:00 2019 +0800
tree f0ad7f8e6740a14b850f9389d7e562d6228aabcc
parent 1aee8389bb762987399a7c588bba37d55a3e17b6

hal: Fix misc audio hal issues

- add array index range check when accessing pcm_device_table
- handle calloc failure
- avoid null pointer dereference

CRs-Fixed: 2456514
Change-Id: I2bedf0f1015e646973acba17297267eb317949ce

hal/audio_hw.c

diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index 6c5b572..d2770f3 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -4977,6 +4977,10 @@
 
     if (alloc_haptic_buffer) {
         adev->haptic_buffer = (uint8_t *)calloc(1, total_haptic_buffer_size);
+        if(adev->haptic_buffer == NULL) {
+            ALOGE("%s: failed to allocate mem for dev->haptic_buffer", __func__);
+            return -ENOMEM;
+        }
         adev->haptic_buffer_size = total_haptic_buffer_size;
     }
 

hal/msm8916/platform.c

diff --git a/hal/msm8916/platform.c b/hal/msm8916/platform.c
index ace49a0..80a52c7 100644
--- a/hal/msm8916/platform.c
+++ b/hal/msm8916/platform.c
@@ -3054,6 +3054,10 @@
 {
     int device_id = -1;
 
+    if ((usecase >= AUDIO_USECASE_MAX) || (usecase <= USECASE_INVALID)) {
+        ALOGE("%s: invalid usecase case idx %d", __func__, usecase);
+        return device_id;
+    }
     if (device_type == PCM_PLAYBACK)
         device_id = pcm_device_table[usecase][0];
     else

hal/msm8960/platform.c

diff --git a/hal/msm8960/platform.c b/hal/msm8960/platform.c
index 416c70b..e16d20a 100644
--- a/hal/msm8960/platform.c
+++ b/hal/msm8960/platform.c
@@ -423,7 +423,12 @@
 
 int platform_get_pcm_device_id(audio_usecase_t usecase, int device_type)
 {
-    int device_id;
+    int device_id = -1;
+
+    if ((usecase >= AUDIO_USECASE_MAX) || (usecase <= USECASE_INVALID)) {
+        ALOGE("%s: invalid usecase case idx %d", __func__, usecase);
+        return device_id;
+    }
     if (device_type == PCM_PLAYBACK)
         device_id = pcm_device_table[usecase][0];
     else

hal/msm8974/platform.c

diff --git a/hal/msm8974/platform.c b/hal/msm8974/platform.c
index 9c2e990..3236aa0 100644
--- a/hal/msm8974/platform.c
+++ b/hal/msm8974/platform.c
@@ -3969,7 +3969,12 @@
 
 int platform_get_pcm_device_id(audio_usecase_t usecase, int device_type)
 {
-    int device_id;
+    int device_id = -1;
+
+    if ((usecase >= AUDIO_USECASE_MAX) || (usecase <= USECASE_INVALID)) {
+        ALOGE("%s: invalid usecase case idx %d", __func__, usecase);
+        return device_id;
+    }
     if (device_type == PCM_PLAYBACK)
         device_id = pcm_device_table[usecase][0];
     else
@@ -3998,7 +4003,7 @@
 int platform_get_delay(void *platform, int pcm_device_id)
 {
     int ctl_len = 0;
-    struct audio_device *adev = ((struct platform_data *)platform)->adev;
+    struct audio_device *adev = NULL;
     struct mixer_ctl *ctl = NULL;
     const char *mixer_ctl_name = "ADSP Path Latency";
     const char *deviceNo = "NN";
@@ -4014,6 +4019,8 @@
         return -EINVAL;
     }
 
+    adev = ((struct platform_data *)platform)->adev;
+
     // Mixer control format: "ADSP Path Latency NN"
     ctl_len = strlen(mixer_ctl_name) + 1 + strlen(deviceNo) + 1;