commit 3e7c86eea2643e91c7463b524fd74da9988d17d7
author Andy Hung <hunga@google.com> Thu Apr 28 13:43:44 2016 -0700
committer The Android Automerger <android-build@google.com> Thu May 26 15:19:59 2016 -0700
tree 0c78ad694de06a2d9f972ffa39171c082ee03215
parent 68f5482b51dc991b6bc2e7c3f269a0d752c3f765

DO NOT MERGE Fix AudioEffect reply overflow

Bug: 28173666
Change-Id: I055af37a721b20c5da0f1ec4b02f630dcd5aee02

post_proc/bundle.c

diff --git a/post_proc/bundle.c b/post_proc/bundle.c
index 8518e54..2c32cb4 100644
--- a/post_proc/bundle.c
+++ b/post_proc/bundle.c
@@ -620,8 +620,9 @@
         if (pCmdData == NULL ||
             cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||
             pReplyData == NULL ||
-            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +
-                               sizeof(uint16_t))) {
+            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||
+            // constrain memcpy below
+            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {
             status = -EINVAL;
             ALOGV("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",
                   cmdSize, *replySize);

voice_processing/voice_processing.c

diff --git a/voice_processing/voice_processing.c b/voice_processing/voice_processing.c
index 08acdb4..e556333 100644
--- a/voice_processing/voice_processing.c
+++ b/voice_processing/voice_processing.c
@@ -559,7 +559,9 @@
             if (pCmdData == NULL ||
                     cmdSize < (int)sizeof(effect_param_t) ||
                     pReplyData == NULL ||
-                    *replySize < (int)sizeof(effect_param_t)) {
+                    *replySize < (int)sizeof(effect_param_t) ||
+                    // constrain memcpy below
+                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {
                 ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");
                 return -EINVAL;
             }