commit f9f246e6f966e87fc7704616c2ebc51db5b0227a
author Aniket Kumar Lata <alata@codeaurora.org> Fri Sep 15 15:20:16 2017 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Mon Sep 18 10:34:04 2017 -0700
tree 59289be68246bc060f1c400680cb67d184f4f866
parent f7d6886ea2ae41fefe7f0897b2b270ff4afafdb8

hal: add checks for possible NULL dereferences in hal

Add checks for possible NULL dereferences in hal.

Change-Id: I56c9238eb7b686628c62c02e5ff635faabb1bd81

hal/audio_extn/utils.c

diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
index 4615de8..0c0f497 100644
--- a/hal/audio_extn/utils.c
+++ b/hal/audio_extn/utils.c
@@ -2301,7 +2301,7 @@
     int ret = -EINVAL, i = 0, j = 0;
     struct audio_usecase *usecase = NULL;
 
-    if (mm_params == NULL && out != NULL) {
+    if (mm_params == NULL || out == NULL) {
         ALOGE("%s:: Invalid mix matrix params", __func__);
         goto exit;
     }
@@ -2313,6 +2313,11 @@
         goto exit;
 
     usecase = get_usecase_from_list(out->dev, out->usecase);
+    if (usecase == NULL) {
+        ALOGE("%s: Invalid usecase", __func__);
+        goto exit;
+    }
+
     out->downmix_params.num_output_channels = mm_params->num_output_channels;
     out->downmix_params.num_input_channels = mm_params->num_input_channels;
 

hal/audio_hw.c

diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index 12bc76b..4ef9c00 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -2794,6 +2794,10 @@
     if (ret == 0) {
         register_out_stream(out);
         if (out->realtime) {
+            if (out->pcm == NULL || !pcm_is_ready(out->pcm)) {
+                ALOGE("%s: pcm stream not ready", __func__);
+                goto error_open;
+            }
             ret = pcm_start(out->pcm);
             if (ret < 0)
                 goto error_open;
@@ -4883,8 +4887,8 @@
     struct stream_in *in = (struct stream_in *)stream;
     struct audio_device *adev = in->dev;
     int ret = 0;
-    unsigned int offset1;
-    unsigned int frames1;
+    unsigned int offset1 = 0;
+    unsigned int frames1 = 0;
     const char *step = "";
 
     pthread_mutex_lock(&adev->lock);