commit fc63f342a51a04c37ee586723e34085956b3317d
author Jasmine Cha <chajasmine@google.com> Wed Jun 27 10:55:06 2018 -0700
committer Jasmine Cha <chajasmine@google.com> Wed Aug 29 06:42:01 2018 +0000
tree 75e01a99c278c632d9e8ca63aef12f4fd915a58d
parent 0b0e165355761bd8a346250f397719caffb4bf96

audio: waves: check array index

If other caller use audio_hw_send_ma_parameter directly,
that would be a risk if we don’t confirm the index before access it.

Bug: 74360112
Test: build pass / Waves effect - preset / LR swap / LR mix

Change-Id: Ibe2cdb025994a4191ffd85665cf27baddf52fe52
Signed-off-by: Jasmine Cha <chajasmine@google.com>

hal/audio_extn/maxxaudio.c

diff --git a/hal/audio_extn/maxxaudio.c b/hal/audio_extn/maxxaudio.c
index fc65332..7caa55e 100644
--- a/hal/audio_extn/maxxaudio.c
+++ b/hal/audio_extn/maxxaudio.c
@@ -62,8 +62,8 @@
 };
 
 typedef enum MA_STREAM_TYPE {
-    STREAM_MIN_STREAM_TYPES,
-    STREAM_VOICE = STREAM_MIN_STREAM_TYPES,
+    STREAM_MIN_TYPES = 0,
+    STREAM_VOICE = STREAM_MIN_TYPES,
     STREAM_SYSTEM,
     STREAM_RING,
     STREAM_MUSIC,
@@ -509,21 +509,28 @@
                              float vol, bool active)
 {
     bool ret = false;
-    ma_stream_type_t stype = (ma_stream_type_t)stream_type;
+    ma_stream_type_t stype;
 
-    ALOGV("%s: stream[%d] vol[%f] active[%s]",
-          __func__, stream_type, vol, active ? "true" : "false");
+    if (stream_type >= STREAM_MAX_TYPES ||
+        stream_type < STREAM_MIN_TYPES) {
+        ALOGE("%s: stream_type %d out of range.", __func__, stream_type);
+        return ret;
+    }
 
     if (!my_data) {
         ALOGV("%s: maxxaudio isn't initialized.", __func__);
         return ret;
     }
 
+    ALOGV("%s: stream[%d] vol[%f] active[%s]",
+          __func__, stream_type, vol, active ? "true" : "false");
+
     // update condition
     // 1. start track: active and volume isn't zero
     // 2. stop track: no tracks are active
     if ((active && vol != 0) ||
         (!active)) {
+        stype = (ma_stream_type_t)stream_type;
         pthread_mutex_lock(&my_data->lock);
 
         ma_cur_state_table[stype].vol = vol;