commit 3ee0f1069e56d74b9cb39de8b0d9701369a4446b
author Andy Hung <hunga@google.com> Sat Nov 05 04:18:55 2016 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Sat Nov 05 04:18:56 2016 +0000
tree 29b025066c2ccf0cb067a80abf7314911225f2b8
parent e73a2461baed796cae0e4a15a6c08835a88a708f
parent 48946cd0cdaddfd8abcf6827ac4836cc111cd89c

Merge "EffectProxy: Check offload reply size"

media/libeffects/proxy/EffectProxy.cpp

diff --git a/media/libeffects/proxy/EffectProxy.cpp b/media/libeffects/proxy/EffectProxy.cpp
index 7decaf6..14ded6a 100644
--- a/media/libeffects/proxy/EffectProxy.cpp
+++ b/media/libeffects/proxy/EffectProxy.cpp
@@ -236,6 +236,11 @@
     // pCmdData points to a memory holding effect_offload_param_t structure
     if (cmdCode == EFFECT_CMD_OFFLOAD) {
         ALOGV("Effect_command() cmdCode = EFFECT_CMD_OFFLOAD");
+        if (replySize == NULL || *replySize < sizeof(int)) {
+            ALOGV("effectsOffload: Effect_command: CMD_OFFLOAD has no reply");
+            android_errorWriteLog(0x534e4554, "32448121");
+            return FAILED_TRANSACTION;
+        }
         if (cmdSize == 0 || pCmdData == NULL) {
             ALOGV("effectsOffload: Effect_command: CMD_OFFLOAD has no data");
              *(int*)pReplyData = FAILED_TRANSACTION;