commit 2e6f6244a8723b6fdb65fd8c1b89c4cd5aeec4c2
author Nikhil Latukar <nlatur@codeaurora.org> Tue Aug 15 13:37:07 2017 +0530
committer Garmond Leung <garmondl@codeaurora.org> Wed Sep 13 16:15:12 2017 -0700
tree 2ff9e167a8c6b605a5ba8780f75339ea5dd2ad88
parent 6ceda20bace7be189833560b97baa5d7fb4f456a

audio: hal: Fix incorrect boundary check for intereactive audio

Fix incorrect boundary check for pan/scale/downmix controls.
Fix be_id being overridden because of incorrect indexing.

Change-Id: I96a2919a0a3df18a0cbaed48f27c1be43cdc68c8
CRs-fixed: 2091555

hal/audio_extn/passthru.c

diff --git a/hal/audio_extn/passthru.c b/hal/audio_extn/passthru.c
index 63f4d92..f70d8ea 100644
--- a/hal/audio_extn/passthru.c
+++ b/hal/audio_extn/passthru.c
@@ -424,7 +424,10 @@
         return false;
     }
 
-    if ((out != NULL) && (out->compr_config.codec->compr_passthr == PASSTHROUGH || out->compr_config.codec->compr_passthr == PASSTHROUGH_IEC61937))
+    if ((out != NULL) &&
+        (out->compr_config.codec != NULL) &&
+        (out->compr_config.codec->compr_passthr == PASSTHROUGH ||
+         out->compr_config.codec->compr_passthr == PASSTHROUGH_IEC61937))
         return true;
     else
         return false;

hal/audio_extn/utils.c

diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
index a993d76..130a6e2 100644
--- a/hal/audio_extn/utils.c
+++ b/hal/audio_extn/utils.c
@@ -2330,9 +2330,11 @@
 
     out->downmix_params.has_mixer_coeffs = mm_params->has_mixer_coeffs;
     for (i = 0; i < mm_params->num_output_channels; i++)
-        for (j = 0; j < mm_params->num_input_channels; j++)
+        for (j = 0; j < mm_params->num_input_channels; j++) {
+            //Convert the channel coefficient gains in Q14 format
             out->downmix_params.mixer_coeffs[i][j] =
-                               mm_params->mixer_coeffs[i][j];
+                               mm_params->mixer_coeffs[i][j] * (2 << 13);
+    }
 
     ret = platform_set_stream_downmix_params(out->dev->platform,
                                              out->pcm_device_id,

hal/audio_hw.c

diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index 23f4d7d..0eab3e6 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -5026,7 +5026,7 @@
     }
 
     /* Init use case and pcm_config */
-#ifndef COMPRESS_VOIP_ENABLED
+#ifndef COMPRES_ENABLED
     if (out->flags == (AUDIO_OUTPUT_FLAG_DIRECT | AUDIO_OUTPUT_FLAG_VOIP_RX) &&
         (out->sample_rate == 8000 || out->sample_rate == 16000 ||
          out->sample_rate == 32000 || out->sample_rate == 48000)) {
@@ -5039,7 +5039,7 @@
         out->config.rate = out->sample_rate;
 
 #else
-    if ((out->dev->mode == AUDIO_MODE_IN_COMMUNICATION || voice_extn_compress_voip_is_active(out->dev)) &&
+    } else if ((out->dev->mode == AUDIO_MODE_IN_COMMUNICATION || voice_extn_compress_voip_is_active(out->dev)) &&
                (out->flags == (AUDIO_OUTPUT_FLAG_DIRECT | AUDIO_OUTPUT_FLAG_VOIP_RX)) &&
                (voice_extn_compress_voip_is_config_supported(config))) {
         ret = voice_extn_compress_voip_open_output_stream(out);

hal/msm8974/platform.c

diff --git a/hal/msm8974/platform.c b/hal/msm8974/platform.c
index 94fe996..9d5ec31 100644
--- a/hal/msm8974/platform.c
+++ b/hal/msm8974/platform.c
@@ -6072,12 +6072,7 @@
     int iter_i = 0;
     int iter_j = 0;
     int length = 0;
-    int pan_scale_data[MAX_LENGTH_MIXER_CONTROL_IN_INT] = {0};
-
-    if (sizeof(mm_params) > MAX_LENGTH_MIXER_CONTROL_IN_INT) {
-        ret = -EINVAL;
-        goto end;
-    }
+    int *pan_scale_data = NULL;
 
     snprintf(mixer_ctl_name, sizeof(mixer_ctl_name),
                           "Audio Stream %d Pan Scale Control", snd_id);
@@ -6090,6 +6085,11 @@
         ret = -EINVAL;
         goto end;
     }
+    pan_scale_data = (int* ) calloc(1, sizeof(mm_params));
+    if (!pan_scale_data) {
+        ret = -ENOMEM;
+        goto end;
+    }
     pan_scale_data[length++] = mm_params.num_output_channels;
     pan_scale_data[length++] = mm_params.num_input_channels;
 
@@ -6123,6 +6123,8 @@
 
     ret = mixer_ctl_set_array(ctl, pan_scale_data, length);
 end:
+    if (pan_scale_data)
+        free(pan_scale_data);
     return ret;
 }
 
@@ -6135,20 +6137,13 @@
     struct audio_device *adev = my_data->adev;
     struct mixer_ctl *ctl;
     char mixer_ctl_name[MIXER_PATH_MAX_LENGTH] = {0};
-    int downmix_param_data[MAX_LENGTH_MIXER_CONTROL_IN_INT] = {0};
+    int *downmix_param_data = NULL;
     int ret = 0;
     int iter_i = 0;
     int iter_j = 0;
     int length = 0;
     int be_idx = 0;
 
-    if ((sizeof(mm_params) +
-         sizeof(be_idx)) >
-        MAX_LENGTH_MIXER_CONTROL_IN_INT) {
-        ret = -EINVAL;
-        goto end;
-    }
-
     snprintf(mixer_ctl_name, sizeof(mixer_ctl_name),
                           "Audio Device %d Downmix Control", snd_id);
     ALOGD("%s mixer_ctl_name:%s", __func__, mixer_ctl_name);
@@ -6160,8 +6155,13 @@
         ret = -EINVAL;
     }
 
+    downmix_param_data = (int* ) calloc(1, sizeof(mm_params) + sizeof(be_idx));
+    if (!downmix_param_data) {
+        ret = -ENOMEM;
+        goto end;
+    }
     be_idx = platform_get_snd_device_backend_index(snd_device);
-    downmix_param_data[length]   = be_idx;
+    downmix_param_data[length++] = be_idx;
     downmix_param_data[length++] = mm_params.num_output_channels;
     downmix_param_data[length++] = mm_params.num_input_channels;
 
@@ -6196,6 +6196,8 @@
 
     ret = mixer_ctl_set_array(ctl, downmix_param_data, length);
 end:
+    if (downmix_param_data)
+        free(downmix_param_data);
     return ret;
 }