RESTRICT AUTOMERGE: aaudio: Fix converting negative FIFO counters to index
The index into the FIFO is calculated by using:
counter % capacity
But the counter is signed and when it is negative the
modulo can have a negative result. That can cause
a negative array index and an access out of bounds.
This is not normally a problem because the counter
is 64 bits and it will not overflow until the audio
has run for a few million years. But a hacker might
be able to modify this internal counter and force
an error.
The solution involves casting to a uint64_t before doing
the modulo.
Note that there may still be a discontinuity when the
counter wraps from -1 to 0. But that will not result
in an out-of-bounds access. It may cause a noise but
an app could simply create a noise directly. So that is
not considered an exploit.
Bug: 120789744
Test: test_atomic_fifo.cpp
Change-Id: I6fe57bcb44528d29b5edb817c592e5e9a8aaf8eb
(cherry picked from commit d1fc53ca84b3d8d074fb27e192dea8204c1fb221)
diff --git a/media/libaaudio/src/fifo/FifoControllerBase.cpp b/media/libaaudio/src/fifo/FifoControllerBase.cpp
index 14a2be1..51a8e34 100644
--- a/media/libaaudio/src/fifo/FifoControllerBase.cpp
+++ b/media/libaaudio/src/fifo/FifoControllerBase.cpp
@@ -38,7 +38,7 @@
fifo_frames_t FifoControllerBase::getReadIndex() {
// % works with non-power of two sizes
- return (fifo_frames_t) (getReadCounter() % mCapacity);
+ return (fifo_frames_t) ((uint64_t)getReadCounter() % mCapacity);
}
void FifoControllerBase::advanceReadIndex(fifo_frames_t numFrames) {
@@ -51,7 +51,7 @@
fifo_frames_t FifoControllerBase::getWriteIndex() {
// % works with non-power of two sizes
- return (fifo_frames_t) (getWriteCounter() % mCapacity);
+ return (fifo_frames_t) ((uint64_t)getWriteCounter() % mCapacity);
}
void FifoControllerBase::advanceWriteIndex(fifo_frames_t numFrames) {
