commit ed6a3848ba2da2f8db19bd6275df602f204786b4
author rago <rago@google.com> Tue Sep 20 06:37:59 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 06:37:59 2016 +0000
tree 4ce8dfefb8ebbe4a54a369d9c6f647a4eb5cef0e
parent f6e202f58fde963533b457220799414d0d3db02d
parent 0f3d9ca91e13be6a5d2ba0bc6a612d37e9bf0daf

Fix potential overflow in Visualizer effect am: 57ac66340a am: 63a995164c am: 38dcbab6b3 am: 624981438d am: 94cc18ee82 am: 3f11c1f175 am: 6a3492d5b5 am: d18f614902 am: 3a3a4f81a4 am: 27ff940a86 am: f3497becae am: 15d69ba580
am: 0f3d9ca91e

Change-Id: Ib38c8fcda1ee304eeb3b9aa563ea6180085174a7

visualizer/offload_visualizer.c

diff --git a/visualizer/offload_visualizer.c b/visualizer/offload_visualizer.c
index 9b25e5e..69cea57 100644
--- a/visualizer/offload_visualizer.c
+++ b/visualizer/offload_visualizer.c
@@ -867,6 +867,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("%s VISUALIZER_CMD_MEASURE error *replySize %d <"
+                    "(sizeof(int32_t) * MEASUREMENT_COUNT) %d",
+                    __func__, *replySize, sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peak_u16 = 0;
         float sum_rms_squared = 0.0f;
         uint8_t nb_valid_meas = 0;