commit 901f65deb49786f4dffd39ac965c0bb681392c0b
author jiabin <jiabin@google.com> Wed Jul 12 17:56:35 2017 -0700
committer jiabin <jiabin@google.com> Fri Jul 14 13:42:46 2017 -0700
tree c80ff068d9aae5d4292387883b24b6be6b2f8ad7
parent 6ac42ebf890ce99b401e1962db8ceecfb38b7a65

Add parameters validation on AAudio MMap server

Bug: 63384314
Test: adb shell /system/bin/write_sine -m -pl -n4 \
&& adb shell /system/bin/write_sine -pl -n4 \
&& adb shell /system/bin/write_sine_callback -m -pl -n4 \
&& adb shell /system/bin/write_sine_callback -pl -n4 \
&& adb shell /system/bin/CtsNativeMediaAAudioTestCases32

Change-Id: I462f956e8fc25eb583699af6389e0f299243eafb

media/libaaudio/src/binding/IAAudioService.cpp

diff --git a/media/libaaudio/src/binding/IAAudioService.cpp b/media/libaaudio/src/binding/IAAudioService.cpp
index 97fbaaa..b3c4934 100644
--- a/media/libaaudio/src/binding/IAAudioService.cpp
+++ b/media/libaaudio/src/binding/IAAudioService.cpp
@@ -264,13 +264,19 @@
         case OPEN_STREAM: {
             CHECK_INTERFACE(IAAudioService, data, reply);
             request.readFromParcel(&data);
-            //ALOGD("BnAAudioService::client openStream request dump --------------------");
-            //request.dump();
-            // Override the uid and pid from the client in case they are incorrect.
-            request.setUserId(IPCThreadState::self()->getCallingUid());
-            request.setProcessId(IPCThreadState::self()->getCallingPid());
-            streamHandle = openStream(request, configuration);
-            //ALOGD("BnAAudioService::onTransact OPEN_STREAM server handle = 0x%08X", streamHandle);
+            result = request.validate();
+            if (result != AAUDIO_OK) {
+                streamHandle = result;
+            } else {
+                //ALOGD("BnAAudioService::client openStream request dump --------------------");
+                //request.dump();
+                // Override the uid and pid from the client in case they are incorrect.
+                request.setUserId(IPCThreadState::self()->getCallingUid());
+                request.setProcessId(IPCThreadState::self()->getCallingPid());
+                streamHandle = openStream(request, configuration);
+                //ALOGD("BnAAudioService::onTransact OPEN_STREAM server handle = 0x%08X",
+                //        streamHandle);
+            }
             reply->writeInt32(streamHandle);
             configuration.writeToParcel(reply);
             return NO_ERROR;