From a6920307f1e7178bbdaca9830b2485979c863b4c Mon Sep 17 00:00:00 2001
From: Eric Laurent <elaurent@google.com>
Date: Thu, 7 Sep 2017 12:35:29 -0700
Subject: [PATCH] sound trigger: fix array overflow in HAL wrapper

Bug: 65383689
Test: make
Change-Id: I9d62eb9be096222bcc3e1734a21f6ade0005b180
---
 soundtrigger/2.0/default/SoundTriggerHalImpl.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp b/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
index 996519b2b8..f963fb1bcc 100644
--- a/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
+++ b/soundtrigger/2.0/default/SoundTriggerHalImpl.cpp
@@ -388,10 +388,12 @@ void SoundTriggerHalImpl::convertTriggerPhraseToHal(
     halTriggerPhrase->id = triggerPhrase->id;
     halTriggerPhrase->recognition_mode = triggerPhrase->recognitionModes;
     unsigned int i;
-    for (i = 0; i < triggerPhrase->users.size(); i++) {
+
+    halTriggerPhrase->num_users =
+        std::min((int)triggerPhrase->users.size(), SOUND_TRIGGER_MAX_USERS);
+    for (i = 0; i < halTriggerPhrase->num_users; i++) {
         halTriggerPhrase->users[i] = triggerPhrase->users[i];
     }
-    halTriggerPhrase->num_users = i;
 
     strlcpy(halTriggerPhrase->locale,
             triggerPhrase->locale.c_str(), SOUND_TRIGGER_MAX_LOCALE_LEN);