EffectBundle: Check value size for get preset name
Test: CTS testAllEffectsEqualizer_CVE_2017_0401
Bug: 37536407
Change-Id: I347af04677fc49a01efb549f06ff81d1a00dc4d0
(cherry picked from commit fa5c6c97ee86ff038979cedea5c449be4e2b9899)
diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
index dcf3fa0..07ea818 100644
--- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
+++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
@@ -2439,6 +2439,13 @@
}
break;
}
+
+ if (*pValueSize < 1) {
+ status = -EINVAL;
+ android_errorWriteLog(0x534e4554, "37536407");
+ break;
+ }
+
name = (char *)pValue;
strncpy(name, EqualizerGetPresetName(param2), *pValueSize - 1);
name[*pValueSize - 1] = 0;