tequilaOS/platform_hardware_interfaces
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[automerge] Fix array out of bound in audioTransportToHal. 2p: f16c6d3a57 2p: 0d43585645 am: 3074154353 am: c9c8e96cfd

Browse source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/19214732

Change-Id: I5ffb19250606281dd1af6b299da2348613fe4fc7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
jiabin 2022-07-11 23:44:30 +00:00 committed by Automerger Merge Worker
commit aaea5644f9
2 changed files with 36 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
audio/common/all-versions/default/7.0/HidlUtils.cpp
View file

@ -898,7 +898,7 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo
for (const auto& transport : transports) {
switch (transport.audioCapability.getDiscriminator()) {
case AudioTransport::AudioCapability::hidl_discriminator::profile:
if (halPort->num_audio_profiles > AUDIO_PORT_MAX_AUDIO_PROFILES) {
if (halPort->num_audio_profiles >= AUDIO_PORT_MAX_AUDIO_PROFILES) {
ALOGE("%s, too many audio profiles", __func__);
result = BAD_VALUE;
break;
@ -914,7 +914,8 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo
result);
break;
case AudioTransport::AudioCapability::hidl_discriminator::edid:
if (halPort->num_extra_audio_descriptors > AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
if (halPort->num_extra_audio_descriptors >=
AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
ALOGE("%s, too many extra audio descriptors", __func__);
result = BAD_VALUE;
break;

42
audio/common/all-versions/default/tests/hidlutils_tests.cpp
View file

@ -954,6 +954,18 @@ TEST(HidlUtils, ConvertAudioPortConfig) {
EXPECT_TRUE(audio_port_configs_are_equal(&halConfig, &halConfigBack));
}
static AudioProfile generateValidAudioProfile() {
AudioProfile profile;
profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
profile.sampleRates.resize(2);
profile.sampleRates[0] = 44100;
profile.sampleRates[1] = 48000;
profile.channelMasks.resize(2);
profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
return profile;
}
TEST(HidlUtils, ConvertInvalidAudioTransports) {
hidl_vec<AudioTransport> invalid;
struct audio_port_v7 halInvalid = {};
@ -973,20 +985,32 @@ TEST(HidlUtils, ConvertInvalidAudioTransports) {
invalid[0].audioCapability.edid(hidl_vec<uint8_t>(EXTRA_AUDIO_DESCRIPTOR_SIZE + 1));
invalid[1].encapsulationType = "random string";
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
// The size of audio profile must not be greater than the maximum value.
invalid.resize(0);
invalid.resize(AUDIO_PORT_MAX_AUDIO_PROFILES + 1);
for (size_t i = 0; i < invalid.size(); ++i) {
invalid[i].audioCapability.profile(generateValidAudioProfile());
invalid[i].encapsulationType =
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);
}
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
// The size of extra audio descriptors must not be greater than the maximum value.
invalid.resize(0);
invalid.resize(AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS + 1);
for (size_t i = 0; i < invalid.size(); ++i) {
invalid[i].audioCapability.edid({0x11, 0x06, 0x01});
invalid[i].encapsulationType =
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_IEC61937);
}
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
}
TEST(HidlUtils, ConvertAudioTransports) {
hidl_vec<AudioTransport> transports;
transports.resize(2);
AudioProfile profile;
profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
profile.sampleRates.resize(2);
profile.sampleRates[0] = 44100;
profile.sampleRates[1] = 48000;
profile.channelMasks.resize(2);
profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
transports[0].audioCapability.profile(profile);
transports[0].audioCapability.profile(generateValidAudioProfile());
hidl_vec<uint8_t> shortAudioDescriptor({0x11, 0x06, 0x01});
transports[0].encapsulationType =
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);