hal: miscellaneous fixes

Fixes for the following issues reported by KW

21725, 21726, 21727, 21737, 21738, 21739, 21740, 21750,
21751, 21752, 25317, 30602, 32620, 36778, 41817, 41819,
50942, 54468, 54470, 54479, 55569, 54481, 55570, 55571,
58485, 85112, 85122, 85123

Change-Id: I9abef07db7ccdc19789a201eb268a97e1b360cad

11 files changed, 177 insertions, 54 deletions

diff --git a/hal/audio_extn/fm.c b/hal/audio_extn/fm.c
index 1d1613a4..b6f8689f 100644
--- a/hal/audio_extn/fm.c
+++ b/hal/audio_extn/fm.c
@@ -148,6 +148,10 @@ static int32_t fm_start(struct audio_device *adev)
     ALOGD("%s: enter", __func__);
 
     uc_info = (struct audio_usecase *)calloc(1, sizeof(struct audio_usecase));
+
+    if (!uc_info)
+        return -ENOMEM;
+
     uc_info->id = USECASE_AUDIO_PLAYBACK_FM;
     uc_info->type = PCM_PLAYBACK;
     uc_info->stream.out = adev->primary_output;
diff --git a/hal/audio_extn/hfp.c b/hal/audio_extn/hfp.c
index 239c975a..43557dc7 100644
--- a/hal/audio_extn/hfp.c
+++ b/hal/audio_extn/hfp.c
@@ -136,6 +136,10 @@ static int32_t start_hfp(struct audio_device *adev,
     ALOGD("%s: enter", __func__);
 
     uc_info = (struct audio_usecase *)calloc(1, sizeof(struct audio_usecase));
+
+    if (!uc_info)
+        return -ENOMEM;
+
     uc_info->id = hfpmod.ucid;
     uc_info->type = PCM_HFP_CALL;
     uc_info->stream.out = adev->primary_output;
diff --git a/hal/audio_extn/listen.c b/hal/audio_extn/listen.c
index b1ed1052..4cb2d2d7 100644
--- a/hal/audio_extn/listen.c
+++ b/hal/audio_extn/listen.c
@@ -200,6 +200,11 @@ int audio_extn_listen_init(struct audio_device *adev, unsigned int snd_card)
         listen_dev = (struct listen_audio_device*)
             calloc(1, sizeof(struct listen_audio_device));
 
+        if (!listen_dev) {
+            ALOGE("failed to allocate listen_dev mem");
+            return -ENOMEM;
+        }
+
         listen_dev->lib_handle = lib_handle;
         listen_dev->adev = adev;
 
diff --git a/hal/audio_extn/ssr.c b/hal/audio_extn/ssr.c
index ac6da8b7..f32d2172 100644
--- a/hal/audio_extn/ssr.c
+++ b/hal/audio_extn/ssr.c
@@ -294,8 +294,8 @@ static int32_t ssr_init_surround_sound_lib(unsigned long buffersize)
     if ( ret > 0 ) {
         ALOGV("%s: Allocating surroundObj size is %d", __func__, ret);
         ssrmod.surround_obj = (void *)malloc(ret);
-        memset(ssrmod.surround_obj,0,ret);
         if (NULL != ssrmod.surround_obj) {
+            memset(ssrmod.surround_obj,0,ret);
             /* initialize after allocating the memory for surround_obj */
             ret = ssrmod.surround_filters_init(ssrmod.surround_obj,
                         6,
diff --git a/hal/audio_extn/usb.c b/hal/audio_extn/usb.c
index bc837097..a4ea1349 100644
--- a/hal/audio_extn/usb.c
+++ b/hal/audio_extn/usb.c
@@ -159,12 +159,16 @@ static int usb_get_capability(char *type, int32_t *channels,
     char *buffer;
     int32_t err = 1;
     int32_t size = 0;
-    int32_t fd, i, channels_playback;
-    char *read_buf, *str_start, *channel_start, *rates_str, *rates_str_for_val,
-    *rates_str_start, *next_sr_str, *test, *next_sr_string, *temp_ptr;
+    int32_t fd=-1, i, channels_playback;
+    char *str_start, *channel_start, *rates_str_start, *next_sr_str,
+         *next_sr_string, *temp_ptr;
     struct stat st;
-    int *rates_supported;
+    char *read_buf = NULL;
+    char *rates_str = NULL;
+    char *rates_str_for_val = NULL;
+    int  *rates_supported = NULL;
     char path[128];
+    int ret = 0;
 
     memset(&st, 0x0, sizeof(struct stat));
     *sample_rate = 0;
@@ -175,45 +179,49 @@ static int usb_get_capability(char *type, int32_t *channels,
     if (fd <0) {
         ALOGE("%s: error failed to open config file %s error: %d\n",
               __func__, path, errno);
-        close(fd);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     if (fstat(fd, &st) < 0) {
         ALOGE("%s: error failed to stat %s error %d\n",
              __func__, path, errno);
-        close(fd);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     file_size = st.st_size;
 
     read_buf = (char *)calloc(1, USB_BUFF_SIZE + 1);
+
+    if (!read_buf) {
+        ALOGE("Failed to create read_buf");
+        ret = -ENOMEM;
+        goto done;
+    }
+
     err = read(fd, read_buf, USB_BUFF_SIZE);
     str_start = strstr(read_buf, type);
     if (str_start == NULL) {
         ALOGE("%s: error %s section not found in usb config file",
                __func__, type);
-        close(fd);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     channel_start = strstr(str_start, "Channels:");
     if (channel_start == NULL) {
         ALOGE("%s: error could not find Channels information", __func__);
-        close(fd);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     channel_start = strstr(channel_start, " ");
     if (channel_start == NULL) {
         ALOGE("%s: error channel section not found in usb config file",
                __func__);
-        close(fd);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     channels_playback = atoi(channel_start);
@@ -227,44 +235,38 @@ static int usb_get_capability(char *type, int32_t *channels,
     rates_str_start = strstr(str_start, "Rates:");
     if (rates_str_start == NULL) {
         ALOGE("%s: error cant find rates information", __func__);
-        close(fd);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     rates_str_start = strstr(rates_str_start, " ");
     if (rates_str_start == NULL) {
         ALOGE("%s: error channel section not found in usb config file",
                __func__);
-        close(fd);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     char *target = strchr(rates_str_start, '\n');
     if (target == NULL) {
         ALOGE("%s: error end of line not found", __func__);
-        close(fd);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     size = target - rates_str_start;
     if ((rates_str = (char *)malloc(size + 1)) == NULL) {
         ALOGE("%s: error unable to allocate memory to hold sample rate strings",
               __func__);
-        close(fd);
-        free(read_buf);
-        return -ENOMEM;
+        ret = -EINVAL;
+        goto done;
     }
 
     if ((rates_str_for_val = (char *)malloc(size + 1)) == NULL) {
         ALOGE("%s: error unable to allocate memory to hold sample rate string",
                __func__);
-        close(fd);
-        free(rates_str);
-        free(read_buf);
-        return -ENOMEM;
+        ret = -EINVAL;
+        goto done;
     }
 
     memcpy(rates_str, rates_str_start, size);
@@ -275,23 +277,23 @@ static int usb_get_capability(char *type, int32_t *channels,
     size = usb_get_numof_rates(rates_str);
     if (!size) {
         ALOGE("%s: error could not get rate size, returning", __func__);
-        close(fd);
-        free(rates_str_for_val);
-        free(rates_str);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     rates_supported = (int *)malloc(sizeof(int) * size);
+
+    if (!rates_supported) {
+        ALOGE("couldn't allocate mem for rates_supported");
+        ret = -EINVAL;
+        goto done;
+    }
+
     next_sr_string = strtok_r(rates_str_for_val, " ,", &temp_ptr);
     if (next_sr_string == NULL) {
         ALOGE("%s: error could not get first rate val", __func__);
-        close(fd);
-        free(rates_str_for_val);
-        free(rates_str);
-        free(rates_supported);
-        free(read_buf);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto done;
     }
 
     rates_supported[0] = atoi(next_sr_string);
@@ -299,6 +301,10 @@ static int usb_get_capability(char *type, int32_t *channels,
            __func__, rates_supported[0]);
     for (i = 1; i<size; i++) {
         next_sr_string = strtok_r(NULL, " ,.-", &temp_ptr);
+        if (next_sr_string == NULL) {
+            rates_supported[i] = -1; // fill in an invalid sr for the rest
+            continue;
+        }
         rates_supported[i] = atoi(next_sr_string);
         ALOGD("rates_supported[%d] for playback: %d",i, rates_supported[i]);
     }
@@ -317,12 +323,13 @@ static int usb_get_capability(char *type, int32_t *channels,
     }
     ALOGD("%s: sample_rate: %d", __func__, *sample_rate);
 
-    close(fd);
-    free(rates_str_for_val);
-    free(rates_str);
-    free(rates_supported);
-    free(read_buf);
-    return 0;
+done:
+    if (fd >= 0) close(fd);
+    if (rates_str_for_val) free(rates_str_for_val);
+    if (rates_str) free(rates_str);
+    if (rates_supported) free(rates_supported);
+    if (read_buf) free(read_buf);
+    return ret;
 }
 
 static int32_t usb_playback_entry(void *adev)
@@ -387,7 +394,6 @@ static int32_t usb_playback_entry(void *adev)
         if(usbmod->proxy_pcm_playback_handle
             && !pcm_is_ready(usbmod->proxy_pcm_playback_handle)){
                      pcm_close(usbmod->proxy_pcm_playback_handle);
-                     usbmod->proxy_pcm_playback_handle = NULL;
                      proxy_open_retry_count--;
                      usleep(USB_PROXY_OPEN_WAIT_TIME * 1000);
                      ALOGE("%s: pcm_open for proxy failed retrying = %d",
@@ -507,7 +513,6 @@ static int32_t usb_record_entry(void *adev)
         if(usbmod->proxy_pcm_record_handle
             && !pcm_is_ready(usbmod->proxy_pcm_record_handle)){
                      pcm_close(usbmod->proxy_pcm_record_handle);
-                     usbmod->proxy_pcm_record_handle = NULL;
                      proxy_open_retry_count--;
                      usleep(USB_PROXY_OPEN_WAIT_TIME * 1000);
                      ALOGE("%s: pcm_open for proxy(recording) failed retrying = %d",
diff --git a/hal/audio_extn/utils.c b/hal/audio_extn/utils.c
index aa663607..e7a57c8d 100644
--- a/hal/audio_extn/utils.c
+++ b/hal/audio_extn/utils.c
@@ -141,6 +141,9 @@ static void parse_format_names(char *name, struct streams_output_cfg *so_info)
         ALOGV("%s: format - %d", __func__, format);
         if (format != 0) {
             sf_info = (struct stream_format *)calloc(1, sizeof(struct stream_format));
+            if (sf_info == NULL)
+                break; /* return whatever was parsed */
+
             sf_info->format = format;
             list_add_tail(&so_info->format_list, &sf_info->list);
         }
@@ -192,6 +195,12 @@ static void update_streams_output_cfg_list(cnode *root, void *platform,
 
     ALOGV("%s", __func__);
     so_info = (struct streams_output_cfg *)calloc(1, sizeof(struct streams_output_cfg));
+
+    if (!so_info) {
+        ALOGE("failed to allocate mem for so_info list element");
+        return;
+    }
+
     while (node) {
         if (strcmp(node->name, FLAGS_TAG) == 0) {
             so_info->flags = parse_flag_names((char *)node->value);
@@ -298,6 +307,11 @@ void audio_extn_utils_update_streams_output_cfg_list(void *platform,
     }
 
     root = config_node("", "");
+    if (root == NULL) {
+        ALOGE("cfg_list, NULL config root");
+        return;
+    }
+
     config_load(root, data);
     load_output(root, platform, streams_output_cfg_list);
 
diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index c1d237c9..38291c04 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -852,6 +852,12 @@ int start_input_stream(struct stream_in *in)
 
     adev->active_input = in;
     uc_info = (struct audio_usecase *)calloc(1, sizeof(struct audio_usecase));
+
+    if (!uc_info) {
+        ret = -ENOMEM;
+        goto error_config;
+    }
+
     uc_info->id = in->usecase;
     uc_info->type = PCM_CAPTURE;
     uc_info->stream.in = in;
@@ -893,6 +899,11 @@ static int send_offload_cmd_l(struct stream_out* out, int command)
 {
     struct offload_cmd *cmd = (struct offload_cmd *)calloc(1, sizeof(struct offload_cmd));
 
+    if (!cmd) {
+        ALOGE("failed to allocate mem for command 0x%x", command);
+        return -ENOMEM;
+    }
+
     ALOGVV("%s %d", __func__, command);
 
     cmd->cmd = command;
@@ -1213,6 +1224,11 @@ int start_output_stream(struct stream_out *out)
     struct audio_device *adev = out->dev;
     int snd_card_status = get_snd_card_state(adev);
 
+    if ((out->usecase < 0) || (out->usecase >= AUDIO_USECASE_MAX)) {
+        ret = -EINVAL;
+        goto error_config;
+    }
+
     ALOGD("%s: enter: stream(%p)usecase(%d: %s) devices(%#x)",
           __func__, &out->stream, out->usecase, use_case_table[out->usecase],
           out->devices);
@@ -1232,6 +1248,12 @@ int start_output_stream(struct stream_out *out)
     }
 
     uc_info = (struct audio_usecase *)calloc(1, sizeof(struct audio_usecase));
+
+    if (!uc_info) {
+        ret = -ENOMEM;
+        goto error_config;
+    }
+
     uc_info->id = out->usecase;
     uc_info->type = PCM_PLAYBACK;
     uc_info->stream.out = out;
@@ -1611,6 +1633,12 @@ static char* out_get_parameters(const struct audio_stream *stream, const char *k
     size_t i, j;
     int ret;
     bool first = true;
+
+    if (!query || !reply) {
+        ALOGE("out_get_parameters: failed to allocate mem for query or reply");
+        return NULL;
+    }
+
     ALOGV("%s: enter: keys - %s", __func__, keys);
     ret = str_parms_get_str(query, AUDIO_PARAMETER_STREAM_SUP_CHANNELS, value, sizeof(value));
     if (ret >= 0) {
@@ -1790,9 +1818,9 @@ static int out_get_render_position(const struct audio_stream_out *stream,
                                    uint32_t *dsp_frames)
 {
     struct stream_out *out = (struct stream_out *)stream;
-    *dsp_frames = 0;
     if (is_offload_usecase(out->usecase) && (dsp_frames != NULL)) {
         ssize_t ret =  -EINVAL;
+        *dsp_frames = 0;
         pthread_mutex_lock(&out->lock);
         if (out->compr != NULL) {
             ret = compress_get_tstamp(out->compr, (unsigned long *)dsp_frames,
@@ -2110,6 +2138,12 @@ static char* in_get_parameters(const struct audio_stream *stream,
     char *str;
     char value[256];
     struct str_parms *reply = str_parms_create();
+
+    if (!query || !reply) {
+        ALOGE("in_get_parameters: failed to create query or reply");
+        return NULL;
+    }
+
     ALOGV("%s: enter: keys - %s", __func__, keys);
 
     voice_extn_in_get_parameters(in, query, reply);
@@ -2343,6 +2377,11 @@ static int adev_open_output_stream(struct audio_hw_device *dev,
         out->compr_config.codec = (struct snd_codec *)
                                     calloc(1, sizeof(struct snd_codec));
 
+        if (!out->compr_config.codec) {
+            ret = -ENOMEM;
+            goto error_open;
+        }
+
         out->usecase = get_offload_usecase(adev);
         if (config->offload_info.channel_mask)
             out->channel_mask = config->offload_info.channel_mask;
@@ -2645,6 +2684,11 @@ static char* adev_get_parameters(const struct audio_hw_device *dev,
     char value[256] = {0};
     int ret = 0;
 
+    if (!query || !reply) {
+        ALOGE("adev_get_parameters: failed to create query or reply");
+        return NULL;
+    }
+
     ret = str_parms_get_str(query, "SND_CARD_STATUS", value,
                             sizeof(value));
     if (ret >=0) {
@@ -2764,6 +2808,12 @@ static int adev_open_input_stream(struct audio_hw_device *dev,
         return -EINVAL;
 
     in = (struct stream_in *)calloc(1, sizeof(struct stream_in));
+
+    if (!in) {
+        ALOGE("failed to allocate input stream");
+        return -ENOMEM;
+    }
+
     ALOGD("%s: enter: sample_rate(%d) channel_mask(%#x) devices(%#x)\
         stream_handle(%p)",__func__, config->sample_rate, config->channel_mask,
         devices, &in->stream);
@@ -2905,6 +2955,11 @@ static int adev_open(const hw_module_t *module, const char *name,
 
     adev = calloc(1, sizeof(struct audio_device));
 
+    if (!adev) {
+        pthread_mutex_unlock(&adev_init_lock);
+        return -ENOMEM;
+    }
+
     pthread_mutex_init(&adev->lock, (const pthread_mutexattr_t *) NULL);
 
     adev->device.common.tag = HARDWARE_DEVICE_TAG;
diff --git a/hal/msm8974/hw_info.c b/hal/msm8974/hw_info.c
index 7ac5ce78..f7d19f4c 100644
--- a/hal/msm8974/hw_info.c
+++ b/hal/msm8974/hw_info.c
@@ -329,6 +329,11 @@ void *hw_info_init(const char *snd_card_name)
     struct hardware_info *hw_info;
 
     hw_info = malloc(sizeof(struct hardware_info));
+    if (!hw_info) {
+        ALOGE("failed to allocate mem for hardware info");
+        return NULL;
+    }
+
     hw_info->snd_devices = NULL;
     hw_info->num_snd_devices = 0;
     strlcpy(hw_info->dev_extn, "", sizeof(hw_info->dev_extn));
diff --git a/hal/msm8974/platform.c b/hal/msm8974/platform.c
index f8535068..5ba33722 100644
--- a/hal/msm8974/platform.c
+++ b/hal/msm8974/platform.c
@@ -477,6 +477,11 @@ static struct csd_data *open_csd_client(bool i2s_ext_modem)
 {
     struct csd_data *csd = calloc(1, sizeof(struct csd_data));
 
+    if (!csd) {
+        ALOGE("failed to allocate csd_data mem");
+        return NULL;
+    }
+
     csd->csd_client = dlopen(LIB_CSD_CLIENT, RTLD_NOW);
     if (csd->csd_client == NULL) {
         ALOGE("%s: DLOPEN failed for %s", __func__, LIB_CSD_CLIENT);
@@ -658,6 +663,11 @@ void *platform_init(struct audio_device *adev)
 
     my_data = calloc(1, sizeof(struct platform_data));
 
+    if (!my_data) {
+        ALOGE("failed to allocate platform data");
+        return NULL;
+    }
+
     while (snd_card_num < MAX_SND_CARD) {
         adev->mixer = mixer_open(snd_card_num);
 
diff --git a/hal/voice.c b/hal/voice.c
index 449c0c25..aa8c29af 100644
--- a/hal/voice.c
+++ b/hal/voice.c
@@ -66,6 +66,11 @@ int stop_call(struct audio_device *adev, audio_usecase_t usecase_id)
     ALOGD("%s: enter usecase:%s", __func__, use_case_table[usecase_id]);
 
     session = (struct voice_session *)voice_get_session_from_use_case(adev, usecase_id);
+    if (!session) {
+        ALOGE("stop_call: couldn't find voice session");
+        return -EINVAL;
+    }
+
     session->state.current = CALL_INACTIVE;
     if (adev->mode == AUDIO_MODE_NORMAL)
         adev->voice.is_in_call = false;
@@ -115,7 +120,17 @@ int start_call(struct audio_device *adev, audio_usecase_t usecase_id)
     ALOGD("%s: enter usecase:%s", __func__, use_case_table[usecase_id]);
 
     session = (struct voice_session *)voice_get_session_from_use_case(adev, usecase_id);
+    if (!session) {
+        ALOGE("start_call: couldn't find voice session");
+        return -EINVAL;
+    }
+
     uc_info = (struct audio_usecase *)calloc(1, sizeof(struct audio_usecase));
+    if (!uc_info) {
+        ALOGE("start_call: couldn't allocate mem for audio_usecase");
+        return -ENOMEM;
+    }
+
     uc_info->id = usecase_id;
     uc_info->type = VOICE_CALL;
     uc_info->stream.out = adev->primary_output;
diff --git a/hal/voice_extn/compress_voip.c b/hal/voice_extn/compress_voip.c
index deb3172c..45e0703e 100644
--- a/hal/voice_extn/compress_voip.c
+++ b/hal/voice_extn/compress_voip.c
@@ -335,6 +335,12 @@ static int voip_start_call(struct audio_device *adev,
     if (uc_info == NULL) {
         ALOGV("%s: voip usecase is added to the list", __func__);
         uc_info = (struct audio_usecase *)calloc(1, sizeof(struct audio_usecase));
+
+        if (!uc_info) {
+            ALOGE("failed to allocate voip usecase mem");
+            return -ENOMEM;
+        }
+
         uc_info->id = USECASE_COMPRESS_VOIP_CALL;
         uc_info->type = VOIP_CALL;
         if (voip_data.out_stream)