diff options
| author | mike dooley <mdooley@google.com> | 2018-12-19 20:20:56 +0100 |
|---|---|---|
| committer | mike dooley <mdooley@google.com> | 2018-12-19 20:20:56 +0100 |
| commit | 25ed3e826ff69b939073ca0cbb810e8f262a252d (patch) | |
| tree | 30c340013e96d999fcc7c5a42a5df9f3dcd48683 /soundtrigger | |
| parent | 1bf027f79d571af21b2c32e505b4899bf673a3c1 (diff) | |
| download | android_hardware_interfaces-25ed3e826ff69b939073ca0cbb810e8f262a252d.tar.gz android_hardware_interfaces-25ed3e826ff69b939073ca0cbb810e8f262a252d.tar.bz2 android_hardware_interfaces-25ed3e826ff69b939073ca0cbb810e8f262a252d.zip | |
Fixing memory corruption bug in sound trigger V2_2
The PhraseSoundModel was being cast to the V2_1 version instead
of V2_0, resulting in memory corruption.
Test: manual test using the SoundTriggerTestApp
Bug: 121265082
Change-Id: If30acd06dd5e2abfdb831287a6f76760e70b20fb
Diffstat (limited to 'soundtrigger')
| -rw-r--r-- | soundtrigger/2.2/default/SoundTriggerHw.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/soundtrigger/2.2/default/SoundTriggerHw.cpp b/soundtrigger/2.2/default/SoundTriggerHw.cpp index 9d930aca7..3cf72c8d8 100644 --- a/soundtrigger/2.2/default/SoundTriggerHw.cpp +++ b/soundtrigger/2.2/default/SoundTriggerHw.cpp @@ -380,8 +380,8 @@ struct sound_trigger_sound_model* SoundTriggerHw::convertSoundModelToHal( "malloc failed for size %zu in convertSoundModelToHal PHRASE", allocSize); - const ISoundTriggerHw::PhraseSoundModel* keyPhraseModel = - reinterpret_cast<const ISoundTriggerHw::PhraseSoundModel*>(soundModel); + const V2_0::ISoundTriggerHw::PhraseSoundModel* keyPhraseModel = + reinterpret_cast<const V2_0::ISoundTriggerHw::PhraseSoundModel*>(soundModel); size_t i; for (i = 0; i < keyPhraseModel->phrases.size() && i < SOUND_TRIGGER_MAX_PHRASES; i++) { |