commit 500a9feaf816c719241de83f2ee65c8e2d7ff269
author rago <rago@google.com> Tue Nov 15 13:00:50 2016 -0800
committer rago <rago@google.com> Tue Nov 15 13:00:50 2016 -0800
tree 99e01aca3cf01c292f0d7ad3bfbb10512d6b4f49
parent ceb7b2d7a4c4cb8d03f166c61f5c7551c6c760aa

Fix security vulnerability: Effect command might allow negative indexes

Bug: 32588016
Bug: 32585400

Test: Use POC bug or cts security test
Change-Id: I5ef8c756369d488ad5903c163584f24de63d73e3

post_proc/equalizer.c

diff --git a/post_proc/equalizer.c b/post_proc/equalizer.c
index 6d12e91..1cd40d2 100644
--- a/post_proc/equalizer.c
+++ b/post_proc/equalizer.c
@@ -325,9 +325,14 @@
 	ALOGV("%s: EQ_PARAM_GET_PRESET_NAME", __func__);
         param2 = *param_tmp;
 	ALOGV("param2: %d", param2);
-        if (param2 >= equalizer_get_num_presets(eq_ctxt)) {
-            p->status = -EINVAL;
-            break;
+        if ((param2 < 0 && param2 != PRESET_CUSTOM) ||
+            param2 >= equalizer_get_num_presets(eq_ctxt)) {
+                p->status = -EINVAL;
+                if (param2 < 0) {
+                    android_errorWriteLog(0x534e4554, "32588016");
+                    ALOGW("\tERROR EQ_PARAM_GET_PRESET_NAME preset %d", param2);
+                }
+                break;
         }
         name = (char *)value;
         strlcpy(name, equalizer_get_preset_name(eq_ctxt, param2), p->vsize - 1);
@@ -385,8 +390,12 @@
 	ALOGV("EQ_PARAM_BAND_LEVEL");
         band =  *param_tmp;
         level = (int32_t)(*(int16_t *)value);
-        if (band >= NUM_EQ_BANDS) {
-           p->status = -EINVAL;
+        if (band < 0 || band >= NUM_EQ_BANDS) {
+            p->status = -EINVAL;
+            if (band < 0) {
+                android_errorWriteLog(0x534e4554, "32585400");
+                ALOGW("\tERROR EQ_PARAM_BAND_LEVEL band %d", band);
+            }
             break;
         }
         equalizer_set_band_level(eq_ctxt, band, level);