From 25ed3e826ff69b939073ca0cbb810e8f262a252d Mon Sep 17 00:00:00 2001
From: mike dooley <mdooley@google.com>
Date: Wed, 19 Dec 2018 20:20:56 +0100
Subject: [PATCH] Fixing memory corruption bug in sound trigger V2_2

The PhraseSoundModel was being cast to the V2_1 version instead
of V2_0, resulting in memory corruption.

Test: manual test using the SoundTriggerTestApp
Bug: 121265082
Change-Id: If30acd06dd5e2abfdb831287a6f76760e70b20fb
---
 soundtrigger/2.2/default/SoundTriggerHw.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/soundtrigger/2.2/default/SoundTriggerHw.cpp b/soundtrigger/2.2/default/SoundTriggerHw.cpp
index 9d930aca7e..3cf72c8d8e 100644
--- a/soundtrigger/2.2/default/SoundTriggerHw.cpp
+++ b/soundtrigger/2.2/default/SoundTriggerHw.cpp
@@ -380,8 +380,8 @@ struct sound_trigger_sound_model* SoundTriggerHw::convertSoundModelToHal(
                             "malloc failed for size %zu in convertSoundModelToHal PHRASE",
                             allocSize);
 
-        const ISoundTriggerHw::PhraseSoundModel* keyPhraseModel =
-            reinterpret_cast<const ISoundTriggerHw::PhraseSoundModel*>(soundModel);
+        const V2_0::ISoundTriggerHw::PhraseSoundModel* keyPhraseModel =
+            reinterpret_cast<const V2_0::ISoundTriggerHw::PhraseSoundModel*>(soundModel);
 
         size_t i;
         for (i = 0; i < keyPhraseModel->phrases.size() && i < SOUND_TRIGGER_MAX_PHRASES; i++) {