commit f16c6d3a5741768356159f099d04bfe2219c81fe
author jiabin <jiabin@google.com> Thu Jul 07 18:13:45 2022 +0000
committer Jiabin Huang <jiabin@google.com> Thu Jul 07 23:24:30 2022 +0000
tree 32400ea4abd27495545a8a5f1d5365faeadf8e5e
parent c8bf2210fa3f4b7d72d44b1c2c9bdca408051bc6

Fix array out of bound in audioTransportToHal.

The number of audio profile and extra audio descriptor must not be
greater than the maximum value.

Bug: 237288416
Bug: 237717857
Test: repo step in bug
Test: atest android.hardware.audio.common@7.0-util_tests
Change-Id: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9
Merged-In: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9
(cherry picked from commit 0ee75ca925f6334741d3e34c5e1d1b0efae5943b)

audio/common/all-versions/default/7.0/HidlUtils.cpp

diff --git a/audio/common/all-versions/default/7.0/HidlUtils.cpp b/audio/common/all-versions/default/7.0/HidlUtils.cpp
index 5a5b5d2..af29da6 100644
--- a/audio/common/all-versions/default/7.0/HidlUtils.cpp
+++ b/audio/common/all-versions/default/7.0/HidlUtils.cpp
@@ -894,7 +894,7 @@
     for (const auto& transport : transports) {
         switch (transport.audioCapability.getDiscriminator()) {
             case AudioTransport::AudioCapability::hidl_discriminator::profile:
-                if (halPort->num_audio_profiles > AUDIO_PORT_MAX_AUDIO_PROFILES) {
+                if (halPort->num_audio_profiles >= AUDIO_PORT_MAX_AUDIO_PROFILES) {
                     ALOGE("%s, too many audio profiles", __func__);
                     result = BAD_VALUE;
                     break;
@@ -910,7 +910,8 @@
                                 result);
                 break;
             case AudioTransport::AudioCapability::hidl_discriminator::edid:
-                if (halPort->num_extra_audio_descriptors > AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
+                if (halPort->num_extra_audio_descriptors >=
+                    AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
                     ALOGE("%s, too many extra audio descriptors", __func__);
                     result = BAD_VALUE;
                     break;