EffectBundle: Check value size for get preset name Test: CTS testAllEffectsEqualizer_CVE_2017_0401 Bug: 37536407 Change-Id: I347af04677fc49a01efb549f06ff81d1a00dc4d0 (cherry picked from commit fa5c6c97ee86ff038979cedea5c449be4e2b9899)
diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp index dcf3fa0..07ea818 100644 --- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp +++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
@@ -2439,6 +2439,13 @@ } break; } + + if (*pValueSize < 1) { + status = -EINVAL; + android_errorWriteLog(0x534e4554, "37536407"); + break; + } + name = (char *)pValue; strncpy(name, EqualizerGetPresetName(param2), *pValueSize - 1); name[*pValueSize - 1] = 0;