commit d18f61490227171b6290ed1aff3185f68734746c
author rago <rago@google.com> Tue Sep 20 02:31:02 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 02:31:02 2016 +0000
tree 397fb2abdd4432483eac1c6d38d813475c1b6ca0
parent ac2e19562a97492f658a4d6bb997d96d4952bfb7
parent 6a3492d5b5d5734aaade5d99a90f135822c3f61e

Fix potential overflow in Visualizer effect am: 57ac66340a am: 63a995164c am: 38dcbab6b3 am: 624981438d am: 94cc18ee82 am: 3f11c1f175
am: 6a3492d5b5

Change-Id: I6ea4855e0658ef5bb4762539660fcbf6f797a798

visualizer/offload_visualizer.c

diff --git a/visualizer/offload_visualizer.c b/visualizer/offload_visualizer.c
index 9b25e5e..69cea57 100644
--- a/visualizer/offload_visualizer.c
+++ b/visualizer/offload_visualizer.c
@@ -867,6 +867,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("%s VISUALIZER_CMD_MEASURE error *replySize %d <"
+                    "(sizeof(int32_t) * MEASUREMENT_COUNT) %d",
+                    __func__, *replySize, sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peak_u16 = 0;
         float sum_rms_squared = 0.0f;
         uint8_t nb_valid_meas = 0;