commit a6920307f1e7178bbdaca9830b2485979c863b4c
author Eric Laurent <elaurent@google.com> Thu Sep 07 12:35:29 2017 -0700
committer Eric Laurent <elaurent@google.com> Thu Sep 07 12:48:41 2017 -0700
tree c91076b3367555622e318f86cb598ac40635661d
parent 1a17e86d76621d7946e5f8e0c7c4bc350d4d211f

sound trigger: fix array overflow in HAL wrapper

Bug: 65383689
Test: make
Change-Id: I9d62eb9be096222bcc3e1734a21f6ade0005b180

soundtrigger/2.0/default/SoundTriggerHalImpl.cpp

diff --git a/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp b/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
index 996519b..f963fb1 100644
--- a/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
+++ b/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
@@ -388,10 +388,12 @@
     halTriggerPhrase->id = triggerPhrase->id;
     halTriggerPhrase->recognition_mode = triggerPhrase->recognitionModes;
     unsigned int i;
-    for (i = 0; i < triggerPhrase->users.size(); i++) {
+
+    halTriggerPhrase->num_users =
+        std::min((int)triggerPhrase->users.size(), SOUND_TRIGGER_MAX_USERS);
+    for (i = 0; i < halTriggerPhrase->num_users; i++) {
         halTriggerPhrase->users[i] = triggerPhrase->users[i];
     }
-    halTriggerPhrase->num_users = i;
 
     strlcpy(halTriggerPhrase->locale,
             triggerPhrase->locale.c_str(), SOUND_TRIGGER_MAX_LOCALE_LEN);