commit 6eca75dacdacc275a0ef5d64f3f446ae5122e0c9
author rago <rago@google.com> Mon Aug 22 17:59:38 2016 -0700
committer gitbuildkicker <android-build@google.com> Wed Oct 12 17:24:41 2016 -0700
tree ce9e7fe705cc80b30ab24cbc41a6905e3b947f7a
parent e9b9903e0d1c07ce694745f56f8046b0e1b997af

Fix potential overflow in Visualizer effect

Bug: 30229821
Change-Id: Iea1c4a21735e893aeded95b980044ec0861a7ea8
(cherry picked from commit 2fa52194ef64843c2908c69527384c6c2fcdbafa)
(cherry picked from commit 57ac66340ad488a17fc285b6fc2635cb7375d72b)

visualizer/offload_visualizer.c

diff --git a/visualizer/offload_visualizer.c b/visualizer/offload_visualizer.c
index 9b25e5e..69cea57 100644
--- a/visualizer/offload_visualizer.c
+++ b/visualizer/offload_visualizer.c
@@ -867,6 +867,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("%s VISUALIZER_CMD_MEASURE error *replySize %d <"
+                    "(sizeof(int32_t) * MEASUREMENT_COUNT) %d",
+                    __func__, *replySize, sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peak_u16 = 0;
         float sum_rms_squared = 0.0f;
         uint8_t nb_valid_meas = 0;