diff options
| author | rago <rago@google.com> | 2016-11-15 13:00:50 -0800 |
|---|---|---|
| committer | gitbuildkicker <android-build@google.com> | 2016-12-01 14:47:07 -0800 |
| commit | ed79f2cc961d7d35fdbbafdd235c1436bcd74358 (patch) | |
| tree | c7bf8b31a1e93bb039d98d4545eb89a122d47b64 | |
| parent | d72ea85c78a1a68bf99fd5804ad9784b4102fe57 (diff) | |
| download | android_hardware_qcom_audio-ed79f2cc961d7d35fdbbafdd235c1436bcd74358.tar.gz android_hardware_qcom_audio-ed79f2cc961d7d35fdbbafdd235c1436bcd74358.tar.bz2 android_hardware_qcom_audio-ed79f2cc961d7d35fdbbafdd235c1436bcd74358.zip | |
Fix security vulnerability: Effect command might allow negative indexes
Bug: 32588016
Bug: 32585400
Test: Use POC bug or cts security test
Change-Id: I5ef8c756369d488ad5903c163584f24de63d73e3
(cherry picked from commit 500a9feaf816c719241de83f2ee65c8e2d7ff269)
| -rw-r--r-- | post_proc/equalizer.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/post_proc/equalizer.c b/post_proc/equalizer.c index 6d12e913..1cd40d26 100644 --- a/post_proc/equalizer.c +++ b/post_proc/equalizer.c @@ -325,9 +325,14 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, ALOGV("%s: EQ_PARAM_GET_PRESET_NAME", __func__); param2 = *param_tmp; ALOGV("param2: %d", param2); - if (param2 >= equalizer_get_num_presets(eq_ctxt)) { - p->status = -EINVAL; - break; + if ((param2 < 0 && param2 != PRESET_CUSTOM) || + param2 >= equalizer_get_num_presets(eq_ctxt)) { + p->status = -EINVAL; + if (param2 < 0) { + android_errorWriteLog(0x534e4554, "32588016"); + ALOGW("\tERROR EQ_PARAM_GET_PRESET_NAME preset %d", param2); + } + break; } name = (char *)value; strlcpy(name, equalizer_get_preset_name(eq_ctxt, param2), p->vsize - 1); @@ -385,8 +390,12 @@ int equalizer_set_parameter(effect_context_t *context, effect_param_t *p, ALOGV("EQ_PARAM_BAND_LEVEL"); band = *param_tmp; level = (int32_t)(*(int16_t *)value); - if (band >= NUM_EQ_BANDS) { - p->status = -EINVAL; + if (band < 0 || band >= NUM_EQ_BANDS) { + p->status = -EINVAL; + if (band < 0) { + android_errorWriteLog(0x534e4554, "32585400"); + ALOGW("\tERROR EQ_PARAM_BAND_LEVEL band %d", band); + } break; } equalizer_set_band_level(eq_ctxt, band, level); |