commit 63a995164cfc88fad6243e6b4f4dccb41529f5ec
author rago <rago@google.com> Tue Sep 20 00:35:05 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 00:35:05 2016 +0000
tree 94e5f8c2a6857bc4482033fe89e2e0b152a9f091
parent 0dac1009bbcae3b4b2fc352e738358e7e76b0a54
parent 57ac66340ad488a17fc285b6fc2635cb7375d72b

Fix potential overflow in Visualizer effect
am: 57ac66340a

Change-Id: I3c8e2f9ee860ac37dc53e9766f12d16f113e82e9

visualizer/offload_visualizer.c

diff --git a/visualizer/offload_visualizer.c b/visualizer/offload_visualizer.c
index eb43558..37a6185 100644
--- a/visualizer/offload_visualizer.c
+++ b/visualizer/offload_visualizer.c
@@ -824,6 +824,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("%s VISUALIZER_CMD_MEASURE error *replySize %d <"
+                    "(sizeof(int32_t) * MEASUREMENT_COUNT) %d",
+                    __func__, *replySize, sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peak_u16 = 0;
         float sum_rms_squared = 0.0f;
         uint8_t nb_valid_meas = 0;