Promotion of av-userspace.lnx.1.0.c2-00007.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
1003337   I30ae78b4392b6beea07762baabad95f25fcceb3b   hal : Fix banned API's and input validation errors
1004601   Ib3ae6a2534474247ed70589c43cb258d297c4440   hal: return with error code to avoid tearing down existi

Change-Id: I0510efe051505aae52ad282479d5534924913fe5
CRs-Fixed: 1004601, 1003337

4 files changed, 15 insertions, 11 deletions

diff --git a/hal/audio_extn/source_track.c b/hal/audio_extn/source_track.c
index 9b6fa0e5..f7f8fb53 100644
--- a/hal/audio_extn/source_track.c
+++ b/hal/audio_extn/source_track.c
@@ -449,8 +449,8 @@ static void send_soundfocus_sourcetracking_params(struct str_parms *reply,
             if ((i >=4) && (sound_focus_data.start_angle[i] == 0xFFFF))
                 continue;
             if (i)
-                snprintf(value + strlen(value) - 1, MAX_STR_SIZE, ",");
-            snprintf(value + strlen(value) - 1, MAX_STR_SIZE, "%d", sound_focus_data.start_angle[i]);
+                snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, ",");
+            snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, "%d", sound_focus_data.start_angle[i]);
         }
         str_parms_add_str(reply, AUDIO_PARAMETER_KEY_SOUND_FOCUS_START_ANGLES, value);
     }
@@ -461,8 +461,8 @@ static void send_soundfocus_sourcetracking_params(struct str_parms *reply,
             if ((i >=4) && (sound_focus_data.enable[i] == 0xFF))
                 continue;
             if (i)
-                snprintf(value + strlen(value), MAX_STR_SIZE, ",");
-            snprintf(value + strlen(value), MAX_STR_SIZE, "%d", sound_focus_data.enable[i]);
+                snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, ",");
+            snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, "%d", sound_focus_data.enable[i]);
         }
         str_parms_add_str(reply, AUDIO_PARAMETER_KEY_SOUND_FOCUS_ENABLE_SECTORS, value);
     }
@@ -476,8 +476,8 @@ static void send_soundfocus_sourcetracking_params(struct str_parms *reply,
             if ((i >=4) && (source_tracking_data.vad[i] == 0xFF))
                 continue;
             if (i)
-                snprintf(value + strlen(value) - 1, MAX_STR_SIZE, ",");
-            snprintf(value + strlen(value) - 1, MAX_STR_SIZE, "%d", source_tracking_data.vad[i]);
+                snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, ",");
+            snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, "%d", source_tracking_data.vad[i]);
         }
         str_parms_add_str(reply, AUDIO_PARAMETER_KEY_SOURCE_TRACK_VAD, value);
     }
@@ -496,8 +496,8 @@ static void send_soundfocus_sourcetracking_params(struct str_parms *reply,
     if (bitmask & BITMASK_AUDIO_PARAMETER_KEY_SOURCE_TRACK_POLAR_ACTIVITY) {
         for (i = 0; i < 360; i++) {
             if (i)
-                snprintf(value + strlen(value) - 1, MAX_STR_SIZE, ",");
-            snprintf(value + strlen(value) - 1, MAX_STR_SIZE, "%d", source_tracking_data.polar_activity[i]);
+                snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, ",");
+            snprintf(value + strlen(value), MAX_STR_SIZE - strlen(value) - 1, "%d", source_tracking_data.polar_activity[i]);
         }
         str_parms_add_str(reply, AUDIO_PARAMETER_KEY_SOURCE_TRACK_POLAR_ACTIVITY, value);
     }
diff --git a/hal/audio_extn/spkr_protection.c b/hal/audio_extn/spkr_protection.c
index 44ff952d..54063f13 100644
--- a/hal/audio_extn/spkr_protection.c
+++ b/hal/audio_extn/spkr_protection.c
@@ -96,6 +96,7 @@
 #define WSA_ANALOG_MODE_CHANNELS 2
 
 #define MAX_PATH             (256)
+#define MAX_STR_SIZE         (1024)
 #define THERMAL_SYSFS "/sys/class/thermal"
 #define TZ_TYPE "/sys/class/thermal/thermal_zone%d/type"
 #define TZ_WSA "/sys/class/thermal/thermal_zone%d/temp"
@@ -967,7 +968,7 @@ static void get_spkr_prot_thermal_cal(char *param)
         ALOGE("%s: failed to open cal file\n", __func__);
         status = -EINVAL;
     }
-    sprintf(param, "SpkrCalStatus: %d; R0: %lf, %lf; T0: %lf, %lf",
+    snprintf(param, MAX_STR_SIZE - strlen(param) - 1, "SpkrCalStatus: %d; R0: %lf, %lf; T0: %lf, %lf",
             status, dr0[SP_V2_SPKR_1], dr0[SP_V2_SPKR_2],
             dt0[SP_V2_SPKR_1], dt0[SP_V2_SPKR_2]);
     ALOGD("%s:: param = %s\n", __func__, param);
@@ -1091,7 +1092,7 @@ static void get_spkr_prot_ftm_param(char *param)
             ftm_status[i] = -EINVAL;
         }
     }
-    sprintf(param, "SpkrParamStatus: %d, %d; Rdc: %lf, %lf; Temp: %lf, %lf;"
+    snprintf(param, MAX_STR_SIZE - strlen(param) - 1, "SpkrParamStatus: %d, %d; Rdc: %lf, %lf; Temp: %lf, %lf;"
             " Freq: %lf, %lf; Rect: %lf, %lf; Qmct: %lf, %lf",
             ftm_status[SP_V2_SPKR_1], ftm_status[SP_V2_SPKR_2],
             rdc[SP_V2_SPKR_1], rdc[SP_V2_SPKR_2], temp[SP_V2_SPKR_1],
diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index d7a3169c..31fd7a1c 100755
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -1192,7 +1192,7 @@ int start_input_stream(struct stream_in *in)
     if (get_usecase_from_list(adev, in->usecase) != NULL) {
         ALOGE("%s: use case assigned already in use, stream(%p)usecase(%d: %s)",
             __func__, &in->stream, in->usecase, use_case_table[in->usecase]);
-        goto error_config;
+        return -EINVAL;
     }
 
     in->pcm_device_id = platform_get_pcm_device_id(in->usecase, PCM_CAPTURE);
diff --git a/hal/msm8916/platform.c b/hal/msm8916/platform.c
index 63eaec62..54163878 100644
--- a/hal/msm8916/platform.c
+++ b/hal/msm8916/platform.c
@@ -3561,6 +3561,9 @@ int platform_set_parameters(void *platform, struct str_parms *parms)
     char *kv_pairs = NULL;
 
     kv_pairs = str_parms_to_str(parms);
+    if(!kv_pairs)
+        return ret;
+
     len = strlen(kv_pairs);
     ALOGV("%s: enter: - %s", __func__, kv_pairs);
     free(kv_pairs);