commit d9e9f33b897a70209257404e14c7ac1be8d3c181
author Jasmine Cha <chajasmine@google.com> Thu May 10 11:05:36 2018 +0800
committer Jasmine Cha <chajasmine@google.com> Thu May 10 13:16:58 2018 +0000
tree 388b070df057e5fbc56524f46072e3df8f713ac6
parent acbca59e60e1b97c95a04b3abb468b23adaf82a0

ma_listener: correct bounds of array

crashed by array index out of bounds.

Bug: 79468907
Bug: 79472606
Bug: 79495729
Test: manual audio test rington/music/alarm/notification

Change-Id: I327ef3b77c7c65064b67dfdc3404cf59d5d84203
Signed-off-by: Jasmine Cha <chajasmine@google.com>

post_proc/ma_listener.c

diff --git a/post_proc/ma_listener.c b/post_proc/ma_listener.c
index 8e57db1..02d45d3 100644
--- a/post_proc/ma_listener.c
+++ b/post_proc/ma_listener.c
@@ -61,7 +61,7 @@
 
 static const audio_stream_type_t MIN_STREAM_TYPES = AUDIO_STREAM_VOICE_CALL;
 static const audio_stream_type_t MAX_STREAM_TYPES = AUDIO_STREAM_NOTIFICATION;
-static struct ma_state g_cur_state[MAX_STREAM_TYPES];
+static struct ma_state g_cur_state[MAX_STREAM_TYPES + 1];
 
 struct ma_listener_context_s {
     const struct effect_interface_s *itfe;
@@ -211,6 +211,8 @@
     else if (max_vol > 1.0) max_vol = 1.0;
 
     if (send_ma_parameter != NULL &&
+        stream_type >= MIN_STREAM_TYPES &&
+        stream_type <= MAX_STREAM_TYPES &&
         (g_cur_state[stream_type].vol != max_vol ||
          g_cur_state[stream_type].active != active)) {