diff options
| author | rago <rago@google.com> | 2016-11-15 13:00:50 -0800 |
|---|---|---|
| committer | Arne Coucheron <arco68@gmail.com> | 2019-09-28 00:23:56 +0200 |
| commit | 64804e241ec2241624ec8f3bb8e25bb0a7360b8b (patch) | |
| tree | f6d3d6d9e7db6e06b318c409c78fd2e2bae2a061 | |
| parent | 3eddbdbab4e7288ad9083a1e4d21902a8a6be48c (diff) | |
| download | hardware_qcom_audio-64804e241ec2241624ec8f3bb8e25bb0a7360b8b.tar.gz hardware_qcom_audio-64804e241ec2241624ec8f3bb8e25bb0a7360b8b.tar.bz2 hardware_qcom_audio-64804e241ec2241624ec8f3bb8e25bb0a7360b8b.zip | |
Fix security vulnerability: Effect command might allow negative indexes
Bug: 32588016
Bug: 32585400
Test: Use POC bug or cts security test
Change-Id: I5ef8c756369d488ad5903c163584f24de63d73e3
(cherry picked from commit 500a9feaf816c719241de83f2ee65c8e2d7ff269)
| -rw-r--r-- | post_proc/equalizer.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/post_proc/equalizer.c b/post_proc/equalizer.c index b35a04a1..8d46883c 100644 --- a/post_proc/equalizer.c +++ b/post_proc/equalizer.c @@ -308,9 +308,14 @@ int equalizer_get_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_GET_PRESET_NAME: param2 = *param_tmp; ALOGV("%s: EQ_PARAM_GET_PRESET_NAME: param2: %d", __func__, param2); - if (param2 >= equalizer_get_num_presets(eq_ctxt)) { - p->status = -EINVAL; - break; + if ((param2 < 0 && param2 != PRESET_CUSTOM) || + param2 >= equalizer_get_num_presets(eq_ctxt)) { + p->status = -EINVAL; + if (param2 < 0) { + android_errorWriteLog(0x534e4554, "32588016"); + ALOGW("\tERROR EQ_PARAM_GET_PRESET_NAME preset %d", param2); + } + break; } name = (char *)value; strlcpy(name, equalizer_get_preset_name(eq_ctxt, param2), p->vsize - 1); @@ -365,8 +370,12 @@ int equalizer_set_parameter(effect_context_t *context, effect_param_t *p, case EQ_PARAM_BAND_LEVEL: band = *param_tmp; level = (int32_t)(*(int16_t *)value); - if (band >= NUM_EQ_BANDS) { - p->status = -EINVAL; + if (band < 0 || band >= NUM_EQ_BANDS) { + p->status = -EINVAL; + if (band < 0) { + android_errorWriteLog(0x534e4554, "32585400"); + ALOGW("\tERROR EQ_PARAM_BAND_LEVEL band %d", band); + } break; } equalizer_set_band_level(eq_ctxt, band, level); |