commit 2e6f6244a8723b6fdb65fd8c1b89c4cd5aeec4c2
author Nikhil Latukar <nlatur@codeaurora.org> Tue Aug 15 13:37:07 2017 +0530
committer Garmond Leung <garmondl@codeaurora.org> Wed Sep 13 16:15:12 2017 -0700
tree 2ff9e167a8c6b605a5ba8780f75339ea5dd2ad88
parent 6ceda20bace7be189833560b97baa5d7fb4f456a

audio: hal: Fix incorrect boundary check for intereactive audio

Fix incorrect boundary check for pan/scale/downmix controls.
Fix be_id being overridden because of incorrect indexing.

Change-Id: I96a2919a0a3df18a0cbaed48f27c1be43cdc68c8
CRs-fixed: 2091555

hal/msm8974/platform.c

diff --git a/hal/msm8974/platform.c b/hal/msm8974/platform.c
index 94fe996..9d5ec31 100644
--- a/hal/msm8974/platform.c
+++ b/hal/msm8974/platform.c
@@ -6072,12 +6072,7 @@
     int iter_i = 0;
     int iter_j = 0;
     int length = 0;
-    int pan_scale_data[MAX_LENGTH_MIXER_CONTROL_IN_INT] = {0};
-
-    if (sizeof(mm_params) > MAX_LENGTH_MIXER_CONTROL_IN_INT) {
-        ret = -EINVAL;
-        goto end;
-    }
+    int *pan_scale_data = NULL;
 
     snprintf(mixer_ctl_name, sizeof(mixer_ctl_name),
                           "Audio Stream %d Pan Scale Control", snd_id);
@@ -6090,6 +6085,11 @@
         ret = -EINVAL;
         goto end;
     }
+    pan_scale_data = (int* ) calloc(1, sizeof(mm_params));
+    if (!pan_scale_data) {
+        ret = -ENOMEM;
+        goto end;
+    }
     pan_scale_data[length++] = mm_params.num_output_channels;
     pan_scale_data[length++] = mm_params.num_input_channels;
 
@@ -6123,6 +6123,8 @@
 
     ret = mixer_ctl_set_array(ctl, pan_scale_data, length);
 end:
+    if (pan_scale_data)
+        free(pan_scale_data);
     return ret;
 }
 
@@ -6135,20 +6137,13 @@
     struct audio_device *adev = my_data->adev;
     struct mixer_ctl *ctl;
     char mixer_ctl_name[MIXER_PATH_MAX_LENGTH] = {0};
-    int downmix_param_data[MAX_LENGTH_MIXER_CONTROL_IN_INT] = {0};
+    int *downmix_param_data = NULL;
     int ret = 0;
     int iter_i = 0;
     int iter_j = 0;
     int length = 0;
     int be_idx = 0;
 
-    if ((sizeof(mm_params) +
-         sizeof(be_idx)) >
-        MAX_LENGTH_MIXER_CONTROL_IN_INT) {
-        ret = -EINVAL;
-        goto end;
-    }
-
     snprintf(mixer_ctl_name, sizeof(mixer_ctl_name),
                           "Audio Device %d Downmix Control", snd_id);
     ALOGD("%s mixer_ctl_name:%s", __func__, mixer_ctl_name);
@@ -6160,8 +6155,13 @@
         ret = -EINVAL;
     }
 
+    downmix_param_data = (int* ) calloc(1, sizeof(mm_params) + sizeof(be_idx));
+    if (!downmix_param_data) {
+        ret = -ENOMEM;
+        goto end;
+    }
     be_idx = platform_get_snd_device_backend_index(snd_device);
-    downmix_param_data[length]   = be_idx;
+    downmix_param_data[length++] = be_idx;
     downmix_param_data[length++] = mm_params.num_output_channels;
     downmix_param_data[length++] = mm_params.num_input_channels;
 
@@ -6196,6 +6196,8 @@
 
     ret = mixer_ctl_set_array(ctl, downmix_param_data, length);
 end:
+    if (downmix_param_data)
+        free(downmix_param_data);
     return ret;
 }