commit 8d833351bd4779b22d000fa3d5541293a0cc5581
author rago <rago@google.com> Tue Sep 20 07:15:01 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 07:15:01 2016 +0000
tree 128f4affaa64e0637e5d4522d0df760305ea7933
parent 68b8f138a56deeed74c075bf6750e9db83026240
parent c5c4747f836e07931283882a729f7250b507f6bf

Fix potential overflow in Visualizer effect am: 46dc714d52 am: 8720f85196 am: bad0250dcb am: 2feb9ce748 am: fba2bd1372 am: dddfa37ec9 am: de6acc18bb am: a0f7a7b07e am: dd6ad5eba7 am: be0844b573 am: 0710743c91 am: 53bc7fcee3 am: a0cc369cbc
am: c5c4747f83

Change-Id: Ia9d53d219bcf5920346f037d88b0bfa52eac226f

media/libeffects/visualizer/EffectVisualizer.cpp

diff --git a/media/libeffects/visualizer/EffectVisualizer.cpp b/media/libeffects/visualizer/EffectVisualizer.cpp
index 0c310c5..91f9fc7 100644
--- a/media/libeffects/visualizer/EffectVisualizer.cpp
+++ b/media/libeffects/visualizer/EffectVisualizer.cpp
@@ -25,6 +25,7 @@
 #include <time.h>
 #include <math.h>
 #include <audio_effects/effect_visualizer.h>
+#include <cutils/log.h>
 
 
 extern "C" {
@@ -599,6 +600,14 @@
         } break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("VISUALIZER_CMD_MEASURE() error *replySize %" PRIu32
+                    " < (sizeof(int32_t) * MEASUREMENT_COUNT) %" PRIu32, *replySize,
+                    sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peakU16 = 0;
         float sumRmsSquared = 0.0f;
         uint8_t nbValidMeasurements = 0;