commit bad0250dcb7f79bb1367db1045c6ca6dfc2238ec
author rago <rago@google.com> Tue Sep 20 00:39:33 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 00:39:33 2016 +0000
tree 14d2afaeeac25ffa01ccadc105851b9bd986f2d7
parent dfe5b5193cfc6321a7ddd3a48ceeaf59097cb545
parent 8720f851962489573b3924b866530bf60373ad9e

Fix potential overflow in Visualizer effect am: 46dc714d52
am: 8720f85196

Change-Id: I0803632824e6fc5a70ad6a1ba36743eb11cc3e7e

media/libeffects/visualizer/EffectVisualizer.cpp

diff --git a/media/libeffects/visualizer/EffectVisualizer.cpp b/media/libeffects/visualizer/EffectVisualizer.cpp
index 4b318c0..bd29cdc 100644
--- a/media/libeffects/visualizer/EffectVisualizer.cpp
+++ b/media/libeffects/visualizer/EffectVisualizer.cpp
@@ -24,6 +24,7 @@
 #include <time.h>
 #include <math.h>
 #include <audio_effects/effect_visualizer.h>
+#include <cutils/log.h>
 
 
 extern "C" {
@@ -597,6 +598,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("VISUALIZER_CMD_MEASURE() error *replySize %" PRIu32
+                    " < (sizeof(int32_t) * MEASUREMENT_COUNT) %" PRIu32, *replySize,
+                    sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peakU16 = 0;
         float sumRmsSquared = 0.0f;
         uint8_t nbValidMeasurements = 0;