commit 48946cd0cdaddfd8abcf6827ac4836cc111cd89c
author Andy Hung <hunga@google.com> Fri Nov 04 16:45:06 2016 -0700
committer Andy Hung <hunga@google.com> Fri Nov 04 17:07:35 2016 -0700
tree c365c4eaf49c4e9a4eb929f8747379658f81ebdb
parent d72ffc4416959d2c94838888c781468b2351716d

EffectProxy: Check offload reply size

Test: Custom test case
Bug: 32448121
Change-Id: Iacdd84097f897e86a188ab6831fd0e11738973d1

media/libeffects/proxy/EffectProxy.cpp

diff --git a/media/libeffects/proxy/EffectProxy.cpp b/media/libeffects/proxy/EffectProxy.cpp
index 7decaf6..14ded6a 100644
--- a/media/libeffects/proxy/EffectProxy.cpp
+++ b/media/libeffects/proxy/EffectProxy.cpp
@@ -236,6 +236,11 @@
     // pCmdData points to a memory holding effect_offload_param_t structure
     if (cmdCode == EFFECT_CMD_OFFLOAD) {
         ALOGV("Effect_command() cmdCode = EFFECT_CMD_OFFLOAD");
+        if (replySize == NULL || *replySize < sizeof(int)) {
+            ALOGV("effectsOffload: Effect_command: CMD_OFFLOAD has no reply");
+            android_errorWriteLog(0x534e4554, "32448121");
+            return FAILED_TRANSACTION;
+        }
         if (cmdSize == 0 || pCmdData == NULL) {
             ALOGV("effectsOffload: Effect_command: CMD_OFFLOAD has no data");
              *(int*)pReplyData = FAILED_TRANSACTION;