diff options
Diffstat (limited to 'audio/effect/all-versions/default/Effect.cpp')
| -rw-r--r-- | audio/effect/all-versions/default/Effect.cpp | 71 |
1 files changed, 57 insertions, 14 deletions
diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp index 3baafc9343..5dc42dc70d 100644 --- a/audio/effect/all-versions/default/Effect.cpp +++ b/audio/effect/all-versions/default/Effect.cpp @@ -238,12 +238,27 @@ void Effect::effectOffloadParamToHal(const EffectOffloadParameter& offload, } // static -std::vector<uint8_t> Effect::parameterToHal(uint32_t paramSize, const void* paramData, - uint32_t valueSize, const void** valueData) { +bool Effect::parameterToHal(uint32_t paramSize, const void* paramData, uint32_t valueSize, + const void** valueData, std::vector<uint8_t>* halParamBuffer) { + constexpr size_t kMaxSize = EFFECT_PARAM_SIZE_MAX - sizeof(effect_param_t); + if (paramSize > kMaxSize) { + ALOGE("%s: Parameter size is too big: %" PRIu32, __func__, paramSize); + return false; + } size_t valueOffsetFromData = alignedSizeIn<uint32_t>(paramSize) * sizeof(uint32_t); + if (valueOffsetFromData > kMaxSize) { + ALOGE("%s: Aligned parameter size is too big: %zu", __func__, valueOffsetFromData); + return false; + } + if (valueSize > kMaxSize - valueOffsetFromData) { + ALOGE("%s: Value size is too big: %" PRIu32 ", max size is %zu", __func__, valueSize, + kMaxSize - valueOffsetFromData); + android_errorWriteLog(0x534e4554, "237291425"); + return false; + } size_t halParamBufferSize = sizeof(effect_param_t) + valueOffsetFromData + valueSize; - std::vector<uint8_t> halParamBuffer(halParamBufferSize, 0); - effect_param_t* halParam = reinterpret_cast<effect_param_t*>(&halParamBuffer[0]); + halParamBuffer->resize(halParamBufferSize, 0); + effect_param_t* halParam = reinterpret_cast<effect_param_t*>(halParamBuffer->data()); halParam->psize = paramSize; halParam->vsize = valueSize; memcpy(halParam->data, paramData, paramSize); @@ -256,7 +271,7 @@ std::vector<uint8_t> Effect::parameterToHal(uint32_t paramSize, const void* para *valueData = halParam->data + valueOffsetFromData; } } - return halParamBuffer; + return true; } Result Effect::analyzeCommandStatus(const char* commandName, const char* context, status_t status) { @@ -301,6 +316,11 @@ void Effect::getConfigImpl(int commandCode, const char* commandName, GetConfigCa Result Effect::getCurrentConfigImpl(uint32_t featureId, uint32_t configSize, GetCurrentConfigSuccessCallback onSuccess) { + if (configSize > kMaxDataSize - sizeof(uint32_t)) { + ALOGE("%s: Config size is too big: %" PRIu32, __func__, configSize); + android_errorWriteLog(0x534e4554, "240266798"); + return Result::INVALID_ARGUMENTS; + } uint32_t halCmd = featureId; std::vector<uint32_t> halResult(alignedSizeIn<uint32_t>(sizeof(uint32_t) + configSize), 0); uint32_t halResultSize = 0; @@ -314,11 +334,15 @@ Result Effect::getParameterImpl(uint32_t paramSize, const void* paramData, GetParameterSuccessCallback onSuccess) { // As it is unknown what method HAL uses for copying the provided parameter data, // it is safer to make sure that input and output buffers do not overlap. - std::vector<uint8_t> halCmdBuffer = - parameterToHal(paramSize, paramData, requestValueSize, nullptr); + std::vector<uint8_t> halCmdBuffer; + if (!parameterToHal(paramSize, paramData, requestValueSize, nullptr, &halCmdBuffer)) { + return Result::INVALID_ARGUMENTS; + } const void* valueData = nullptr; - std::vector<uint8_t> halParamBuffer = - parameterToHal(paramSize, paramData, replyValueSize, &valueData); + std::vector<uint8_t> halParamBuffer; + if (!parameterToHal(paramSize, paramData, replyValueSize, &valueData, &halParamBuffer)) { + return Result::INVALID_ARGUMENTS; + } uint32_t halParamBufferSize = halParamBuffer.size(); return sendCommandReturningStatusAndData( @@ -331,8 +355,12 @@ Result Effect::getParameterImpl(uint32_t paramSize, const void* paramData, Result Effect::getSupportedConfigsImpl(uint32_t featureId, uint32_t maxConfigs, uint32_t configSize, GetSupportedConfigsSuccessCallback onSuccess) { + if (maxConfigs != 0 && configSize > (kMaxDataSize - 2 * sizeof(uint32_t)) / maxConfigs) { + ALOGE("%s: Config size is too big: %" PRIu32, __func__, configSize); + return Result::INVALID_ARGUMENTS; + } uint32_t halCmd[2] = {featureId, maxConfigs}; - uint32_t halResultSize = 2 * sizeof(uint32_t) + maxConfigs * sizeof(configSize); + uint32_t halResultSize = 2 * sizeof(uint32_t) + maxConfigs * configSize; std::vector<uint8_t> halResult(static_cast<size_t>(halResultSize), 0); return sendCommandReturningStatusAndData( EFFECT_CMD_GET_FEATURE_SUPPORTED_CONFIGS, "GET_FEATURE_SUPPORTED_CONFIGS", sizeof(halCmd), @@ -472,8 +500,10 @@ Result Effect::setConfigImpl(int commandCode, const char* commandName, const Eff Result Effect::setParameterImpl(uint32_t paramSize, const void* paramData, uint32_t valueSize, const void* valueData) { - std::vector<uint8_t> halParamBuffer = - parameterToHal(paramSize, paramData, valueSize, &valueData); + std::vector<uint8_t> halParamBuffer; + if (!parameterToHal(paramSize, paramData, valueSize, &valueData, &halParamBuffer)) { + return Result::INVALID_ARGUMENTS; + } return sendCommandReturningStatus(EFFECT_CMD_SET_PARAM, "SET_PARAM", halParamBuffer.size(), &halParamBuffer[0]); } @@ -670,8 +700,21 @@ Return<void> Effect::command(uint32_t commandId, const hidl_vec<uint8_t>& data, void* dataPtr = halDataSize > 0 ? &halData[0] : NULL; void* resultPtr = halResultSize > 0 ? &halResult[0] : NULL; - status_t status = - (*mHandle)->command(mHandle, commandId, halDataSize, dataPtr, &halResultSize, resultPtr); + status_t status = BAD_VALUE; + switch (commandId) { + case 'gtid': // retrieve the tid, used for spatializer priority boost + if (halDataSize == 0 && resultMaxSize == sizeof(int32_t)) { + auto ptid = (int32_t*)resultPtr; + ptid[0] = mProcessThread ? mProcessThread->getTid() : -1; + status = OK; + break; // we have handled 'gtid' here. + } + [[fallthrough]]; // allow 'gtid' overload (checked halDataSize and resultMaxSize). + default: + status = (*mHandle)->command(mHandle, commandId, halDataSize, dataPtr, &halResultSize, + resultPtr); + break; + } hidl_vec<uint8_t> result; if (status == OK && resultPtr != NULL) { result.setToExternal(&halResult[0], halResultSize); |