commit c4f80a51c733077d9863b06fef54ea906ddcd1cf
author Mikhail Naganov <mnaganov@google.com> Tue Oct 31 20:11:47 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Oct 31 20:11:47 2017 +0000
tree df8b1352a30043014deb72adc0491f0a200d54f6
parent c4a74e354a69ccab03de00863b27050eed51a10a
parent 7d2b91dde7ac623720aec91de70d189c6a74fd53

Merge "Add EFFECT_CMD_SET_PARAM parameter checking to Preset Reverb" into lmp-mr1-dev am: 31b0c9cb33 am: be30bb2645 am: e2d671ce19 am: 8aa73cce69 am: 3785a50ef4 am: a060ca58ff am: dee287e40c am: 9dc85bf51e am: 59e93ab3ab am: 3b564f6e42 am: 62e3e59029 am: 26214cfbaa am: 1fee4c334c
am: 7d2b91dde7

Change-Id: I10718d7a04a337009a47ddc8f2bf1ec3e538c5f8

media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp

diff --git a/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp b/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp
index ee9406d..3d8e982 100644
--- a/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp
+++ b/media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp
@@ -1889,6 +1889,10 @@
         if (param != REVERB_PARAM_PRESET) {
             return -EINVAL;
         }
+        if (vsize < (int)sizeof(uint16_t)) {
+            android_errorWriteLog(0x534e4554, "67647856");
+            return -EINVAL;
+        }
 
         uint16_t preset = *(uint16_t *)pValue;
         ALOGV("set REVERB_PARAM_PRESET, preset %d", preset);