tree 1141863657b353cc99f1b68944fc5b388ceafff4
parent 0be59f934c089ffd42bc9d54ebaed06e7fbe9dba
author Kevin Rocard <krocard@google.com> 1510600527 -0800
committer android-build-team Robot <android-build-team-robot@google.com> 1519327945 +0000

IAudioPolicyService: Add attribute tags sanitization

When audio_attributes_t was read from the binder parcel,
the string tags field was copied without checking that
it contained a '\0'.

This could lead to read past the end when tags were used.

This patch always adds a '\0' at the end of the buffer when
deserializing.

Bug: 68953950
Test: manual playback/record
Test: send binder payload without \0 in tags attribute, check that only
      AUDIO_ATTRIBUTES_TAGS_MAX_SIZE - 1 char are printed.
Change-Id: I285258cbf7cfaf26b191d1f31b3b1e2d724c4934
Merged-In: I285258cbf7cfaf26b191d1f31b3b1e2d724c4934
Signed-off-by: Kevin Rocard <krocard@google.com>
(cherry picked from commit ab4d9f873ae433d75fbd7bd9af0aa4f7c3bcd92c)