Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 11:36:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix array out of bound in audioTransportToHal.

Browse Source 
The number of audio profile and extra audio descriptor must not be
greater than the maximum value.

Bug: 237288416
Bug: 237717857
Test: repo step in bug
Test: atest android.hardware.audio.common@7.0-util_tests
Change-Id: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9
Merged-In: I1fcfa29d7841a1cb73bafb1ea92f3b1630992ae9
(cherry picked from commit 0ee75ca925)
This commit is contained in:
jiabin
2022-07-07 18:13:45 +00:00
committed by Jiabin Huang
parent c8bf2210fa
commit f16c6d3a57
2 changed files with 36 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
audio/common/all-versions/default/7.0/HidlUtils.cpp
View File

@@ -894,7 +894,7 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo
for (const auto& transport : transports) {
switch (transport.audioCapability.getDiscriminator()) {
case AudioTransport::AudioCapability::hidl_discriminator::profile:
if (halPort->num_audio_profiles > AUDIO_PORT_MAX_AUDIO_PROFILES) {
if (halPort->num_audio_profiles >= AUDIO_PORT_MAX_AUDIO_PROFILES) {
ALOGE("%s, too many audio profiles", __func__);
result = BAD_VALUE;
break;
@@ -910,7 +910,8 @@ status_t HidlUtils::audioTransportsToHal(const hidl_vec<AudioTransport>& transpo
result);
break;
case AudioTransport::AudioCapability::hidl_discriminator::edid:
if (halPort->num_extra_audio_descriptors > AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
if (halPort->num_extra_audio_descriptors >=
AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
ALOGE("%s, too many extra audio descriptors", __func__);
result = BAD_VALUE;
break;

42
audio/common/all-versions/default/tests/hidlutils_tests.cpp
View File

@@ -954,6 +954,18 @@ TEST(HidlUtils, ConvertAudioPortConfig) {
EXPECT_TRUE(audio_port_configs_are_equal(&halConfig, &halConfigBack));
}
static AudioProfile generateValidAudioProfile() {
AudioProfile profile;
profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
profile.sampleRates.resize(2);
profile.sampleRates[0] = 44100;
profile.sampleRates[1] = 48000;
profile.channelMasks.resize(2);
profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
return profile;
}
TEST(HidlUtils, ConvertInvalidAudioTransports) {
hidl_vec<AudioTransport> invalid;
struct audio_port_v7 halInvalid = {};
@@ -973,20 +985,32 @@ TEST(HidlUtils, ConvertInvalidAudioTransports) {
invalid[0].audioCapability.edid(hidl_vec<uint8_t>(EXTRA_AUDIO_DESCRIPTOR_SIZE + 1));
invalid[1].encapsulationType = "random string";
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
// The size of audio profile must not be greater than the maximum value.
invalid.resize(0);
invalid.resize(AUDIO_PORT_MAX_AUDIO_PROFILES + 1);
for (size_t i = 0; i < invalid.size(); ++i) {
invalid[i].audioCapability.profile(generateValidAudioProfile());
invalid[i].encapsulationType =
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);
}
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
// The size of extra audio descriptors must not be greater than the maximum value.
invalid.resize(0);
invalid.resize(AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS + 1);
for (size_t i = 0; i < invalid.size(); ++i) {
invalid[i].audioCapability.edid({0x11, 0x06, 0x01});
invalid[i].encapsulationType =
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_IEC61937);
}
EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
}
TEST(HidlUtils, ConvertAudioTransports) {
hidl_vec<AudioTransport> transports;
transports.resize(2);
AudioProfile profile;
profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
profile.sampleRates.resize(2);
profile.sampleRates[0] = 44100;
profile.sampleRates[1] = 48000;
profile.channelMasks.resize(2);
profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
transports[0].audioCapability.profile(profile);
transports[0].audioCapability.profile(generateValidAudioProfile());
hidl_vec<uint8_t> shortAudioDescriptor({0x11, 0x06, 0x01});
transports[0].encapsulationType =
toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);