commit 139ca758beceb973576c8a5359f0bc3bd64d6893
author Eino-Ville Talvala <etalvala@google.com> Fri Apr 23 15:40:34 2021 -0700
committer Eino-Ville Talvala <etalvala@google.com> Fri Apr 23 15:43:16 2021 -0700
tree 69762e7498b874f7ef7c90de45a29a1804ea9294
parent a1335e1aa895546d2dea67a20ebec4652e81925c

CameraService: Bounds-check argument to playSound

To ensure no out-of-bound array access is possible.

Test: Sounds still play when using API1
Bug: 181198806
Change-Id: Ibe42ce9addb70752d84785d50e1fd106ec84774c

services/camera/libcameraservice/CameraService.cpp

diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index edee734..65f27b1 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -2724,6 +2724,11 @@
     ATRACE_CALL();
 
     LOG1("playSound(%d)", kind);
+    if (kind < 0 || kind >= NUM_SOUNDS) {
+        ALOGE("%s: Invalid sound id requested: %d", __FUNCTION__, kind);
+        return;
+    }
+
     Mutex::Autolock lock(mSoundLock);
     loadSoundLocked(kind);
     sp<MediaPlayer> player = mSoundPlayer[kind];