commit 21de6aae315d57014d10112dabae3d85094bab04
author Divya Narayanan Poojary <dnaray@codeaurora.org> Fri Jan 06 12:07:19 2017 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Mon Apr 10 02:11:48 2017 -0700
tree da5e1a8e42475ce8037c1306e96b60c49dd8ea87
parent 29b894e8c465802d2343f2e5956df47a90a56eb6

hal: fix for KW issues.

- Handle array bound violations

Change-Id: Ia6b2e184e8f4e133f91889afb8e1b8f3213ab7f0

hal/msm8916/platform.c

diff --git a/hal/msm8916/platform.c b/hal/msm8916/platform.c
index f887904..de3bcd8 100644
--- a/hal/msm8916/platform.c
+++ b/hal/msm8916/platform.c
@@ -5913,12 +5913,12 @@
     char mixer_ctl_name[44] = {0}; // max length of name is 44 as defined
     int ret;
     unsigned int i;
-    int set_values[8] = {0};
+    int set_values[FCC_8] = {0};
     struct platform_data *my_data = (struct platform_data *)platform;
     struct audio_device *adev = my_data->adev;
     ALOGV("%s channel_count:%d",__func__, ch_count);
-    if (NULL == ch_map) {
-        ALOGE("%s: Invalid channel mapping used", __func__);
+    if (NULL == ch_map || (ch_count < 1) || (ch_count > FCC_8)) {
+        ALOGE("%s: Invalid channel mapping or channel count value", __func__);
         return -EINVAL;
     }
 
@@ -5940,7 +5940,7 @@
               __func__, mixer_ctl_name);
         return -EINVAL;
     }
-    for (i = 0; i< ARRAY_SIZE(set_values); i++) {
+    for (i = 0; i < (unsigned int)ch_count; i++) {
         set_values[i] = ch_map[i];
     }
 
@@ -5948,7 +5948,7 @@
         set_values[0], set_values[1], set_values[2], set_values[3], set_values[4],
         set_values[5], set_values[6], set_values[7], ch_count);
 
-    ret = mixer_ctl_set_array(ctl, set_values, ch_count);
+    ret = mixer_ctl_set_array(ctl, set_values, ARRAY_SIZE(set_values));
     if (ret < 0) {
         ALOGE("%s: Could not set ctl, error:%d ch_count:%d",
               __func__, ret, ch_count);

hal/msm8974/platform.c

diff --git a/hal/msm8974/platform.c b/hal/msm8974/platform.c
index 93b28ca..94f2c0f 100644
--- a/hal/msm8974/platform.c
+++ b/hal/msm8974/platform.c
@@ -5755,12 +5755,12 @@
     char mixer_ctl_name[44] = {0}; // max length of name is 44 as defined
     int ret;
     unsigned int i;
-    int set_values[8] = {0};
+    int set_values[FCC_8] = {0};
     struct platform_data *my_data = (struct platform_data *)platform;
     struct audio_device *adev = my_data->adev;
     ALOGV("%s channel_count:%d",__func__, ch_count);
-    if (NULL == ch_map) {
-        ALOGE("%s: Invalid channel mapping used", __func__);
+    if (NULL == ch_map || (ch_count < 1) || (ch_count > FCC_8)) {
+        ALOGE("%s: Invalid channel mapping or channel count value", __func__);
         return -EINVAL;
     }
 
@@ -5782,7 +5782,7 @@
               __func__, mixer_ctl_name);
         return -EINVAL;
     }
-    for (i = 0; i< ARRAY_SIZE(set_values); i++) {
+    for (i = 0; i < (unsigned int)ch_count; i++) {
         set_values[i] = ch_map[i];
     }
 
@@ -5790,7 +5790,7 @@
         set_values[0], set_values[1], set_values[2], set_values[3], set_values[4],
         set_values[5], set_values[6], set_values[7], ch_count);
 
-    ret = mixer_ctl_set_array(ctl, set_values, ch_count);
+    ret = mixer_ctl_set_array(ctl, set_values, ARRAY_SIZE(set_values));
     if (ret < 0) {
         ALOGE("%s: Could not set ctl, error:%d ch_count:%d",
               __func__, ret, ch_count);