commit f3497becaecadfd105578fe441d4cdb334e69871
author rago <rago@google.com> Tue Sep 20 04:33:40 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 04:33:40 2016 +0000
tree 7a5ea8d54acec8fdfcaf6dc37cdab743b202558d
parent 753d35f4843dee40d4357889fad828d03d7f490a
parent 27ff940a86b6ad4ebe812e7706db921b7fb78693

Fix potential overflow in Visualizer effect am: 57ac66340a am: 63a995164c am: 38dcbab6b3 am: 624981438d am: 94cc18ee82 am: 3f11c1f175 am: 6a3492d5b5 am: d18f614902 am: 3a3a4f81a4
am: 27ff940a86

Change-Id: Icf16159080f132d4a0bf5e0beaba8a1d4c878154

visualizer/offload_visualizer.c

diff --git a/visualizer/offload_visualizer.c b/visualizer/offload_visualizer.c
index 9b25e5e..69cea57 100644
--- a/visualizer/offload_visualizer.c
+++ b/visualizer/offload_visualizer.c
@@ -867,6 +867,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("%s VISUALIZER_CMD_MEASURE error *replySize %d <"
+                    "(sizeof(int32_t) * MEASUREMENT_COUNT) %d",
+                    __func__, *replySize, sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peak_u16 = 0;
         float sum_rms_squared = 0.0f;
         uint8_t nb_valid_meas = 0;