commit 62b3932268c6cddba81aff8ba40dc35a09174511
author Andy Hung <hunga@google.com> Tue May 16 15:30:17 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Jul 26 23:53:44 2017 +0000
tree ec2955adfd405c33d84caf328ab9ff49e051f011
parent ccc0aff34b6936953af75c61c0ff011904310579

Equalizer: Check value size for get preset name

Test: see CTS testAllEffectsEqualizer_CVE_2017_0401
Bug: 37536407
Change-Id: Ifa515dea10c9293022b7d0971d097f0bd727ac6c
(cherry picked from commit 8cf151a63177247a370ecdef6f2e1ec0b80901d5)

post_proc/equalizer.c

diff --git a/post_proc/equalizer.c b/post_proc/equalizer.c
index 8c9449a..4e4552f 100644
--- a/post_proc/equalizer.c
+++ b/post_proc/equalizer.c
@@ -334,6 +334,13 @@
                 }
                 break;
         }
+
+        if (p->vsize < 1) {
+            p->status = -EINVAL;
+            android_errorWriteLog(0x534e4554, "37536407");
+            break;
+        }
+
         name = (char *)value;
         strlcpy(name, equalizer_get_preset_name(eq_ctxt, param2), p->vsize - 1);
         name[p->vsize - 1] = 0;