diff options
| -rw-r--r-- | include/media/IAudioPolicyService.h | 2 | ||||
| -rw-r--r-- | media/libmedia/IAudioPolicyService.cpp | 12 |
2 files changed, 14 insertions, 0 deletions
diff --git a/include/media/IAudioPolicyService.h b/include/media/IAudioPolicyService.h index 1df91ee140..3db966e281 100644 --- a/include/media/IAudioPolicyService.h +++ b/include/media/IAudioPolicyService.h @@ -180,6 +180,8 @@ public: const Parcel& data, Parcel* reply, uint32_t flags = 0); +private: + void sanetizeAudioAttributes(audio_attributes_t* attr); }; // ---------------------------------------------------------------------------- diff --git a/media/libmedia/IAudioPolicyService.cpp b/media/libmedia/IAudioPolicyService.cpp index abae614645..e1bd5611a5 100644 --- a/media/libmedia/IAudioPolicyService.cpp +++ b/media/libmedia/IAudioPolicyService.cpp @@ -883,6 +883,7 @@ status_t BnAudioPolicyService::onTransact( bool hasAttributes = data.readInt32() != 0; if (hasAttributes) { data.read(&attr, sizeof(audio_attributes_t)); + sanetizeAudioAttributes(&attr); } audio_session_t session = (audio_session_t)data.readInt32(); audio_stream_type_t stream = AUDIO_STREAM_DEFAULT; @@ -950,6 +951,7 @@ status_t BnAudioPolicyService::onTransact( CHECK_INTERFACE(IAudioPolicyService, data, reply); audio_attributes_t attr; data.read(&attr, sizeof(audio_attributes_t)); + sanetizeAudioAttributes(&attr); audio_session_t session = (audio_session_t)data.readInt32(); uid_t uid = (uid_t)data.readInt32(); uint32_t samplingRate = data.readInt32(); @@ -1338,6 +1340,7 @@ status_t BnAudioPolicyService::onTransact( data.read(&source, sizeof(struct audio_port_config)); audio_attributes_t attributes; data.read(&attributes, sizeof(audio_attributes_t)); + sanetizeAudioAttributes(&attributes); audio_io_handle_t handle = {}; status_t status = startAudioSource(&source, &attributes, &handle); reply->writeInt32(status); @@ -1358,6 +1361,15 @@ status_t BnAudioPolicyService::onTransact( } } +void BnAudioPolicyService::sanetizeAudioAttributes(audio_attributes_t* attr) +{ + const size_t tagsMaxSize = AUDIO_ATTRIBUTES_TAGS_MAX_SIZE; + if (strnlen(attr->tags, tagsMaxSize) >= tagsMaxSize) { + android_errorWriteLog(0x534e4554, "68953950"); // SafetyNet logging + } + attr->tags[tagsMaxSize - 1] = '\0'; +} + // ---------------------------------------------------------------------------- } // namespace android |