diff options
author | rago <rago@google.com> | 2016-11-15 13:00:50 -0800 |
---|---|---|
committer | mh0rst <mhorst@tzi.de> | 2017-01-13 10:34:49 +0100 |
commit | a66b28ebd1117778f025deaab2cf042d3e5ac74c (patch) | |
tree | c1cbf9c4f0ba7f0a1a4516e46f88154f6c303b19 | |
parent | 8bb55861cda0462d59d6f96adc877c59690b12d4 (diff) | |
download | android_hardware_qcom_audio-a66b28ebd1117778f025deaab2cf042d3e5ac74c.tar.gz android_hardware_qcom_audio-a66b28ebd1117778f025deaab2cf042d3e5ac74c.tar.bz2 android_hardware_qcom_audio-a66b28ebd1117778f025deaab2cf042d3e5ac74c.zip |
Fix security vulnerability: Effect command might allow negative indexes
Bug: 32588016
Bug: 32585400
Test: Use POC bug or cts security test
Change-Id: I5ef8c756369d488ad5903c163584f24de63d73e3
(cherry picked from commit 500a9feaf816c719241de83f2ee65c8e2d7ff269)
(cherry picked from commit ed79f2cc961d7d35fdbbafdd235c1436bcd74358)
# Conflicts:
# post_proc/equalizer.c
Fix security vulnerability: Equalizer command might allow negative indexes
Bug: 32247948
Bug: 32438598
Bug: 32436341
Test: use POC on bug or cts security test
Change-Id: I56a92582687599b5b313dea1abcb8bcb19c7fc0e
(cherry picked from commit 3f37d4ef89f4f0eef9e201c5a91b7b2c77ed1071)
(cherry picked from commit ceb7b2d7a4c4cb8d03f166c61f5c7551c6c760aa)
(cherry picked from commit d72ea85c78a1a68bf99fd5804ad9784b4102fe57)
-rw-r--r-- | post_proc/equalizer.c | 39 |
1 files changed, 30 insertions, 9 deletions
diff --git a/post_proc/equalizer.c b/post_proc/equalizer.c index a26e4131..9af4ff0d 100644 --- a/post_proc/equalizer.c +++ b/post_proc/equalizer.c @@ -264,8 +264,12 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_BAND_LEVEL: param2 = *param_tmp; - if (param2 >= NUM_EQ_BANDS) { + if (param2 < 0 || param2 >= NUM_EQ_BANDS) { p->status = -EINVAL; + if (param2 < 0) { + android_errorWriteLog(0x534e4554, "32438598"); + ALOGW("\tERROR EQ_PARAM_BAND_LEVEL band %d", param2); + } break; } *(int16_t *)value = (int16_t)equalizer_get_band_level(eq_ctxt, param2); @@ -273,8 +277,12 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_CENTER_FREQ: param2 = *param_tmp; - if (param2 >= NUM_EQ_BANDS) { - p->status = -EINVAL; + if (param2 < 0 || param2 >= NUM_EQ_BANDS) { + p->status = -EINVAL; + if (param2 < 0) { + android_errorWriteLog(0x534e4554, "32436341"); + ALOGW("\tERROR EQ_PARAM_CENTER_FREQ band %d", param2); + } break; } *(int32_t *)value = equalizer_get_center_frequency(eq_ctxt, param2); @@ -282,8 +290,12 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_BAND_FREQ_RANGE: param2 = *param_tmp; - if (param2 >= NUM_EQ_BANDS) { + if (param2 < 0 || param2 >= NUM_EQ_BANDS) { p->status = -EINVAL; + if (param2 < 0) { + android_errorWriteLog(0x534e4554, "32247948"); + ALOGW("\tERROR EQ_PARAM_BAND_FREQ_RANGE band %d", param2); + } break; } equalizer_get_band_freq_range(eq_ctxt, param2, (uint32_t *)value, @@ -306,9 +318,14 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_GET_PRESET_NAME: param2 = *param_tmp; ALOGV("%s: EQ_PARAM_GET_PRESET_NAME: param2: %d", __func__, param2); - if (param2 >= equalizer_get_num_presets(eq_ctxt)) { - p->status = -EINVAL; - break; + if ((param2 < 0 && param2 != PRESET_CUSTOM) || + param2 >= equalizer_get_num_presets(eq_ctxt)) { + p->status = -EINVAL; + if (param2 < 0) { + android_errorWriteLog(0x534e4554, "32588016"); + ALOGW("\tERROR EQ_PARAM_GET_PRESET_NAME preset %d", param2); + } + break; } name = (char *)value; strlcpy(name, equalizer_get_preset_name(eq_ctxt, param2), p->vsize - 1); @@ -363,8 +380,12 @@ int equalizer_set_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_BAND_LEVEL: band = *param_tmp; level = (int32_t)(*(int16_t *)value); - if (band >= NUM_EQ_BANDS) { - p->status = -EINVAL; + if (band < 0 || band >= NUM_EQ_BANDS) { + p->status = -EINVAL; + if (band < 0) { + android_errorWriteLog(0x534e4554, "32585400"); + ALOGW("\tERROR EQ_PARAM_BAND_LEVEL band %d", band); + } break; } equalizer_set_band_level(eq_ctxt, band, level); |