Merge changes from topic 'vts-audio-fix' into oc-dev

* changes:
  Audio HAL: Destroy EventFlag on failed prepareTo{write,read}
  Audio HAL: Check for buffer size overflow
  Audio HAL: Detect buffer memory allocation failure
  Audio HAL: Detect openDevice failure
  Audio HAL VTS: Fix documentation

1 files changed, 28 insertions, 7 deletions

diff --git a/audio/2.0/default/StreamIn.cpp b/audio/2.0/default/StreamIn.cpp
index 2745607e8b..0798bbea9d 100644
--- a/audio/2.0/default/StreamIn.cpp
+++ b/audio/2.0/default/StreamIn.cpp
@@ -20,6 +20,7 @@
 
 #include <android/log.h>
 #include <hardware/audio.h>
+#include <memory>
 #include <utils/Trace.h>
 
 #include "StreamIn.h"
@@ -52,7 +53,11 @@ class ReadThread : public Thread {
               mDataMQ(dataMQ),
               mStatusMQ(statusMQ),
               mEfGroup(efGroup),
-              mBuffer(new uint8_t[dataMQ->getQuantumCount()]) {
+              mBuffer(nullptr) {
+    }
+    bool init() {
+        mBuffer.reset(new(std::nothrow) uint8_t[mDataMQ->getQuantumCount()]);
+        return mBuffer != nullptr;
     }
     virtual ~ReadThread() {}
 
@@ -308,8 +313,14 @@ Return<void> StreamIn::prepareForReading(
         return Void();
     }
     std::unique_ptr<CommandMQ> tempCommandMQ(new CommandMQ(1));
-    std::unique_ptr<DataMQ> tempDataMQ(
-            new DataMQ(frameSize * framesCount, true /* EventFlag */));
+    if (frameSize > std::numeric_limits<size_t>::max() / framesCount) {
+        ALOGE("Requested buffer is too big, %d*%d can not fit in size_t", frameSize, framesCount);
+        _hidl_cb(Result::INVALID_ARGUMENTS,
+                CommandMQ::Descriptor(), DataMQ::Descriptor(), StatusMQ::Descriptor(), threadInfo);
+        return Void();
+    }
+    std::unique_ptr<DataMQ> tempDataMQ(new DataMQ(frameSize * framesCount, true /* EventFlag */));
+
     std::unique_ptr<StatusMQ> tempStatusMQ(new StatusMQ(1));
     if (!tempCommandMQ->isValid() || !tempDataMQ->isValid() || !tempStatusMQ->isValid()) {
         ALOGE_IF(!tempCommandMQ->isValid(), "command MQ is invalid");
@@ -319,8 +330,11 @@ Return<void> StreamIn::prepareForReading(
                 CommandMQ::Descriptor(), DataMQ::Descriptor(), StatusMQ::Descriptor(), threadInfo);
         return Void();
     }
-    status = EventFlag::createEventFlag(tempDataMQ->getEventFlagWord(), &mEfGroup);
-    if (status != OK || !mEfGroup) {
+    EventFlag* tempRawEfGroup{};
+    status = EventFlag::createEventFlag(tempDataMQ->getEventFlagWord(), &tempRawEfGroup);
+    std::unique_ptr<EventFlag, void(*)(EventFlag*)> tempElfGroup(tempRawEfGroup, [](auto *ef) {
+            EventFlag::deleteEventFlag(&ef); });
+    if (status != OK || !tempElfGroup) {
         ALOGE("failed creating event flag for data MQ: %s", strerror(-status));
         _hidl_cb(Result::INVALID_ARGUMENTS,
                 CommandMQ::Descriptor(), DataMQ::Descriptor(), StatusMQ::Descriptor(), threadInfo);
@@ -328,13 +342,18 @@ Return<void> StreamIn::prepareForReading(
     }
 
     // Create and launch the thread.
-    mReadThread = new ReadThread(
+    auto tempReadThread = std::make_unique<ReadThread>(
             &mStopReadThread,
             mStream,
             tempCommandMQ.get(),
             tempDataMQ.get(),
             tempStatusMQ.get(),
-            mEfGroup);
+            tempElfGroup.get());
+    if (!tempReadThread->init()) {
+        _hidl_cb(Result::INVALID_ARGUMENTS,
+                CommandMQ::Descriptor(), DataMQ::Descriptor(), StatusMQ::Descriptor(), threadInfo);
+        return Void();
+    }
     status = mReadThread->run("reader", PRIORITY_URGENT_AUDIO);
     if (status != OK) {
         ALOGW("failed to start reader thread: %s", strerror(-status));
@@ -346,6 +365,8 @@ Return<void> StreamIn::prepareForReading(
     mCommandMQ = std::move(tempCommandMQ);
     mDataMQ = std::move(tempDataMQ);
     mStatusMQ = std::move(tempStatusMQ);
+    mReadThread = tempReadThread.release();
+    mEfGroup = tempElfGroup.release();
     threadInfo.pid = getpid();
     threadInfo.tid = mReadThread->getTid();
     _hidl_cb(Result::OK,