commit 8cf151a63177247a370ecdef6f2e1ec0b80901d5
author Andy Hung <hunga@google.com> Tue May 16 15:30:17 2017 -0700
committer Andy Hung <hunga@google.com> Tue May 16 22:41:30 2017 +0000
tree db86eb4adca7c7d0e9f3c357a1ea23902770a5c9
parent 500a9feaf816c719241de83f2ee65c8e2d7ff269

Equalizer: Check value size for get preset name

Test: see CTS testAllEffectsEqualizer_CVE_2017_0401
Bug: 37536407
Change-Id: Ifa515dea10c9293022b7d0971d097f0bd727ac6c

post_proc/equalizer.c

diff --git a/post_proc/equalizer.c b/post_proc/equalizer.c
index 1cd40d2..d776fc4 100644
--- a/post_proc/equalizer.c
+++ b/post_proc/equalizer.c
@@ -334,6 +334,13 @@
                 }
                 break;
         }
+
+        if (p->vsize < 1) {
+            p->status = -EINVAL;
+            android_errorWriteLog(0x534e4554, "37536407");
+            break;
+        }
+
         name = (char *)value;
         strlcpy(name, equalizer_get_preset_name(eq_ctxt, param2), p->vsize - 1);
         name[p->vsize - 1] = 0;