commit 761ce6cdda6ebcebba56b4f6230a33adeac5d861
author Pallavi <pallavim@codeaurora.org> Thu Jul 13 17:32:22 2017 +0530
committer Shiv Maliyappanahalli <smaliyap@codeaurora.org> Tue Aug 15 15:02:20 2017 -0700
tree 42f48308afa3d871091e88df7c575c31db718099
parent 93f080ecd86d7088fce150981a85274b94786bfc

hal: fix null pointer references and data initialization errors

  - add null pointer check and initialize uninitialized variables

CRs-Fixed: 2075786
Change-Id: I3e983673f36005be795a0d3adb3c54b5dcf0f002

hal/audio_extn/keep_alive.c

diff --git a/hal/audio_extn/keep_alive.c b/hal/audio_extn/keep_alive.c
index 87cb122..8bd1da1 100644
--- a/hal/audio_extn/keep_alive.c
+++ b/hal/audio_extn/keep_alive.c
@@ -114,6 +114,11 @@
     struct keep_alive_cmd *cmd =
         (struct keep_alive_cmd *)calloc(1, sizeof(struct keep_alive_cmd));
 
+    if (cmd == NULL) {
+        ALOGE("%s: cmd is NULL", __func__);
+        return -ENOMEM;
+    }
+
     cmd->req = r;
     list_add_tail(&ka.cmd_list, &cmd->node);
     pthread_cond_signal(&ka.cond);
@@ -271,6 +276,12 @@
 
     /*send calibration*/
     usecase = calloc(1, sizeof(struct audio_usecase));
+
+    if (usecase == NULL) {
+        ALOGE("%s: usecase is NULL", __func__);
+        rc = -ENOMEM;
+        goto exit;
+    }
     usecase->type = PCM_PLAYBACK;
     usecase->out_snd_device = snd_device;
 

hal/audio_hw_extn_api.c

diff --git a/hal/audio_hw_extn_api.c b/hal/audio_hw_extn_api.c
index 0ee927e..20a27e8 100644
--- a/hal/audio_hw_extn_api.c
+++ b/hal/audio_hw_extn_api.c
@@ -325,7 +325,7 @@
             bytes_written = bytes;
         }
         ALOGV("%s: flag 0x%x, bytes %zd, read %zd, ret %zd timestamp 0x%"PRIx64"",
-              __func__, out->flags, bytes, bytes_written, ret, *timestamp);
+              __func__, out->flags, bytes, bytes_written, ret, timestamp == NULL ? 0 : *timestamp);
     } else {
         bytes_written = out->qahwi_out.base.write(&out->stream, buffer, bytes);
         ALOGV("%s: flag 0x%x, bytes %zd, read %zd, ret %zd",

qahw_api/test/qahw_effect_test.c

diff --git a/qahw_api/test/qahw_effect_test.c b/qahw_api/test/qahw_effect_test.c
index 61b73a7..bc249f3 100644
--- a/qahw_api/test/qahw_effect_test.c
+++ b/qahw_api/test/qahw_effect_test.c
@@ -755,7 +755,7 @@
     int                      reply_data;
     uint32_t                 reply_size = sizeof(int);
     uint32_t array_size = sizeof(qahw_effect_param_t) + 2 * sizeof(int32_t);
-    uint32_t      buf32[array_size];
+    uint32_t      buf32[array_size], buf32_2[array_size];
     qahw_effect_param_t *values;
     int enable;
 
@@ -794,6 +794,8 @@
             }
             if (thr_ctxt->cmd_code == QAHW_EFFECT_CMD_ENABLE || thr_ctxt->cmd_code == QAHW_EFFECT_CMD_DISABLE) {
                 enable = ((thr_ctxt->cmd_code == QAHW_EFFECT_CMD_ENABLE) ? 1 : 0);
+
+                values = (qahw_effect_param_t *)buf32_2;
                 values->psize = 2 * sizeof(int32_t);
                 values->vsize = sizeof(int32_t);
                 *(int32_t *)values->data = ASPHERE_PARAM_ENABLE;