commit d4881f84060670553efcb9c445a7c48aeaed0dfa
author rago <rago@google.com> Tue Nov 15 23:43:09 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Nov 15 23:43:09 2016 +0000
tree 6b20458cc3e18842950581f6c919b9c2886b7a89
parent c236ae3ad09b8d7a459daad3041af214b4b648f6
parent 9bf3487e7a33a85c4270f65abe4bc3e3c0848bcf

Fix security vulnerability: Effect command might allow negative indexes am: 01183402d7 am: 94e3424b74
am: 9bf3487e7a

Change-Id: Ia36571a591829777096ad41316b7edf169ce9a6c

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
index fc09fa6..728b4ed 100644
--- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
+++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
@@ -2351,9 +2351,13 @@
 
     case EQ_PARAM_GET_PRESET_NAME:
         param2 = *pParamTemp;
-        if (param2 >= EqualizerGetNumPresets()) {
-        //if (param2 >= 20) {     // AGO FIX
+        if ((param2 < 0 && param2 != PRESET_CUSTOM) ||  param2 >= EqualizerGetNumPresets()) {
             status = -EINVAL;
+            if (param2 < 0) {
+                android_errorWriteLog(0x534e4554, "32448258");
+                ALOGE("\tERROR Equalizer_getParameter() EQ_PARAM_GET_PRESET_NAME preset %d",
+                        param2);
+            }
             break;
         }
         name = (char *)pValue;
@@ -2423,8 +2427,12 @@
         band =  *pParamTemp;
         level = (int32_t)(*(int16_t *)pValue);
         //ALOGV("\tEqualizer_setParameter() EQ_PARAM_BAND_LEVEL band %d, level %d", band, level);
-        if (band >= FIVEBAND_NUMBANDS) {
+        if (band < 0 || band >= FIVEBAND_NUMBANDS) {
             status = -EINVAL;
+            if (band < 0) {
+                android_errorWriteLog(0x534e4554, "32095626");
+                ALOGE("\tERROR Equalizer_setParameter() EQ_PARAM_BAND_LEVEL band %d", band);
+            }
             break;
         }
         EqualizerSetBandLevel(pContext, band, level);