Skip to content

Commit 9bce12a

Browse files
flammeAndroid Build Coastguard Worker
authored andcommitted
Fix array out of bound in audioTransportToHal.
The number of audio profile and extra audio descriptor must not be greater than the maximum value. Bug: 237288416 Bug: 237717857 Test: repo step in bug Test: atest android.hardware.audio.common@7.0-util_tests Change-Id: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9 Merged-In: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9 (cherry picked from commit 0ee75ca) (cherry picked from commit f16c6d3) Merged-In: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9
1 parent ad2871f commit 9bce12a

File tree

2 files changed

+36
-11
lines changed

2 files changed

+36
-11
lines changed

audio/common/all-versions/default/7.0/HidlUtils.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -898,7 +898,7 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo
898898
for (const auto& transport : transports) {
899899
switch (transport.audioCapability.getDiscriminator()) {
900900
case AudioTransport::AudioCapability::hidl_discriminator::profile:
901-
if (halPort->num_audio_profiles > AUDIO_PORT_MAX_AUDIO_PROFILES) {
901+
if (halPort->num_audio_profiles >= AUDIO_PORT_MAX_AUDIO_PROFILES) {
902902
ALOGE("%s, too many audio profiles", __func__);
903903
result = BAD_VALUE;
904904
break;
@@ -914,7 +914,8 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo
914914
result);
915915
break;
916916
case AudioTransport::AudioCapability::hidl_discriminator::edid:
917-
if (halPort->num_extra_audio_descriptors > AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
917+
if (halPort->num_extra_audio_descriptors >=
918+
AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
918919
ALOGE("%s, too many extra audio descriptors", __func__);
919920
result = BAD_VALUE;
920921
break;

audio/common/all-versions/default/tests/hidlutils_tests.cpp

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -954,6 +954,18 @@ TEST(HidlUtils, ConvertAudioPortConfig) {
954954
EXPECT_TRUE(audio_port_configs_are_equal(&halConfig, &halConfigBack));
955955
}
956956

957+
static AudioProfile generateValidAudioProfile() {
958+
AudioProfile profile;
959+
profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
960+
profile.sampleRates.resize(2);
961+
profile.sampleRates[0] = 44100;
962+
profile.sampleRates[1] = 48000;
963+
profile.channelMasks.resize(2);
964+
profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
965+
profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
966+
return profile;
967+
}
968+
957969
TEST(HidlUtils, ConvertInvalidAudioTransports) {
958970
hidl_vec<AudioTransport> invalid;
959971
struct audio_port_v7 halInvalid = {};
@@ -973,20 +985,32 @@ TEST(HidlUtils, ConvertInvalidAudioTransports) {
973985
invalid[0].audioCapability.edid(hidl_vec<uint8_t>(EXTRA_AUDIO_DESCRIPTOR_SIZE + 1));
974986
invalid[1].encapsulationType = "random string";
975987
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
988+
989+
// The size of audio profile must not be greater than the maximum value.
990+
invalid.resize(0);
991+
invalid.resize(AUDIO_PORT_MAX_AUDIO_PROFILES + 1);
992+
for (size_t i = 0; i < invalid.size(); ++i) {
993+
invalid[i].audioCapability.profile(generateValidAudioProfile());
994+
invalid[i].encapsulationType =
995+
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);
996+
}
997+
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
998+
999+
// The size of extra audio descriptors must not be greater than the maximum value.
1000+
invalid.resize(0);
1001+
invalid.resize(AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS + 1);
1002+
for (size_t i = 0; i < invalid.size(); ++i) {
1003+
invalid[i].audioCapability.edid({0x11, 0x06, 0x01});
1004+
invalid[i].encapsulationType =
1005+
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_IEC61937);
1006+
}
1007+
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
9761008
}
9771009

9781010
TEST(HidlUtils, ConvertAudioTransports) {
9791011
hidl_vec<AudioTransport> transports;
9801012
transports.resize(2);
981-
AudioProfile profile;
982-
profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
983-
profile.sampleRates.resize(2);
984-
profile.sampleRates[0] = 44100;
985-
profile.sampleRates[1] = 48000;
986-
profile.channelMasks.resize(2);
987-
profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
988-
profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
989-
transports[0].audioCapability.profile(profile);
1013+
transports[0].audioCapability.profile(generateValidAudioProfile());
9901014
hidl_vec<uint8_t> shortAudioDescriptor({0x11, 0x06, 0x01});
9911015
transports[0].encapsulationType =
9921016
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);

0 commit comments

Comments
 (0)