Merge "AudioSecurityTest: verify equalizer get parameter name" into klp-dev
diff --git a/tests/tests/security/src/android/security/cts/AudioSecurityTest.java b/tests/tests/security/src/android/security/cts/AudioSecurityTest.java
index 77a8847..3dacbe7 100644
--- a/tests/tests/security/src/android/security/cts/AudioSecurityTest.java
+++ b/tests/tests/security/src/android/security/cts/AudioSecurityTest.java
@@ -20,6 +20,7 @@
import android.media.AudioManager;
import android.media.AudioTrack;
import android.media.audiofx.AudioEffect;
+import android.media.audiofx.Equalizer;
import android.util.Log;
import com.android.cts.util.SecurityTest;
@@ -74,10 +75,12 @@
testEffect.test(audioEffect);
Log.d(TAG, "effect " + testName + " " + descriptor.name + " success");
} catch (Exception e) {
- Log.e(TAG, "effect " + testName + " " + descriptor.name + " failed!");
+ Log.e(TAG, "effect " + testName + " " + descriptor.name + " exception failed!",
+ e);
++failures;
} catch (AssertionError e) {
- Log.e(TAG, "effect " + testName + " " + descriptor.name + " failed!");
+ Log.e(TAG, "effect " + testName + " " + descriptor.name + " assert failed!",
+ e);
++failures;
}
}
@@ -123,7 +126,18 @@
});
}
+ // b/37536407
@SecurityTest
+ public void testAllEffectsEqualizer_CVE_2017_0401() throws Exception {
+ testAllEffects("equalizer get parameter name",
+ new TestEffect() {
+ @Override
+ public void test(AudioEffect audioEffect) throws Exception {
+ testAudioEffectEqualizerGetParameterName(audioEffect);
+ }
+ });
+ }
+
private static void testAudioEffectGetParameter(
AudioEffect audioEffect, boolean offload) throws Exception {
if (audioEffect == null) {
@@ -303,6 +317,37 @@
}
}
+ private static void testAudioEffectEqualizerGetParameterName(
+ AudioEffect audioEffect) throws Exception {
+ if (audioEffect == null) {
+ return;
+ }
+ try {
+ // get parameter name with zero vsize
+ {
+ final int param = Equalizer.PARAM_GET_PRESET_NAME;
+ final int band = 0;
+ byte command[] = ByteBuffer.allocate(5 * 4 /* capacity */)
+ .order(ByteOrder.nativeOrder())
+ .putInt(0) // status (unused)
+ .putInt(8) // psize (param, band)
+ .putInt(0) // vsize
+ .putInt(param) // equalizer param
+ .putInt(band) // equalizer band
+ .array();
+ Integer ret = (Integer) AudioEffect.class.getDeclaredMethod(
+ "command", int.class, byte[].class, byte[].class).invoke(
+ audioEffect, EFFECT_CMD_GET_PARAM, command,
+ new byte[5 * 4] /* reply - ignored */);
+ assertTrue("Audio server might have crashed", ret != ERROR_DEAD_OBJECT);
+ }
+ } catch (NoSuchMethodException e) {
+ Log.w(TAG, "AudioEffect.command() does not exist (ignoring)"); // OK
+ } finally {
+ audioEffect.release();
+ }
+ }
+
// should match effect_visualizer.h (native)
private static final String VISUALIZER_TYPE = "e46b26a0-dddd-11db-8afd-0002a5d5c51b";
private static final int VISUALIZER_CMD_CAPTURE = 0x10000;