commit 8cd8d232d34d32e88cc48cbfac87d7206220e794
author Colin Cross <ccross@android.com> Fri Sep 30 04:24:30 2016 +0000
committer android-build-merger <android-build-merger@google.com> Fri Sep 30 04:24:30 2016 +0000
tree 172d598dda04784bc14e5e76f4e19d6a00fe5429
parent 53c4169a758802cbaef603a4285289eed6a30fe6
parent 8fce0b19eecca4af19adffdc4612a16d73214ba1

Merge "Update escaping in Android.bp files" am: 1bfae98559
am: 8fce0b19ee

Change-Id: Idecdefd6e64c44e7496d17cad5d76113799df874

audio_effects/include/audio_effects/effect_visualizer.h

diff --git a/audio_effects/include/audio_effects/effect_visualizer.h b/audio_effects/include/audio_effects/effect_visualizer.h
index cfd99f5..fe46d7f 100644
--- a/audio_effects/include/audio_effects/effect_visualizer.h
+++ b/audio_effects/include/audio_effects/effect_visualizer.h
@@ -41,6 +41,7 @@
 
 #define MEASUREMENT_IDX_PEAK 0
 #define MEASUREMENT_IDX_RMS  1
+#define MEASUREMENT_COUNT 2
 
 /* enumerated parameters for Visualizer effect */
 typedef enum

camera/src/camera_metadata.c

diff --git a/camera/src/camera_metadata.c b/camera/src/camera_metadata.c
index 9491e8e..4b0ed4f 100644
--- a/camera/src/camera_metadata.c
+++ b/camera/src/camera_metadata.c
@@ -25,9 +25,10 @@
 #include <stdlib.h>
 #include <errno.h>
 
-#define OK         0
-#define ERROR      1
-#define NOT_FOUND (-ENOENT)
+#define OK              0
+#define ERROR           1
+#define NOT_FOUND       (-ENOENT)
+#define SN_EVENT_LOG_ID 0x534e4554
 
 #define ALIGN_TO(val, alignment) \
     (((uintptr_t)(val) + ((alignment) - 1)) & ~((alignment) - 1))
@@ -305,6 +306,38 @@
     return metadata;
 }
 
+// This method should be used when the camera metadata cannot be trusted. For example, when it's
+// read from Parcel.
+static int validate_and_calculate_camera_metadata_entry_data_size(size_t *data_size, uint8_t type,
+        size_t data_count) {
+    if (type >= NUM_TYPES) return ERROR;
+
+    // Check for overflow
+    if (data_count != 0 &&
+            camera_metadata_type_size[type] > (SIZE_MAX - DATA_ALIGNMENT + 1) / data_count) {
+        android_errorWriteLog(SN_EVENT_LOG_ID, "30741779");
+        return ERROR;
+    }
+
+    size_t data_bytes = data_count * camera_metadata_type_size[type];
+
+    if (data_size) {
+        *data_size = data_bytes <= 4 ? 0 : ALIGN_TO(data_bytes, DATA_ALIGNMENT);
+    }
+
+    return OK;
+}
+
+size_t calculate_camera_metadata_entry_data_size(uint8_t type,
+        size_t data_count) {
+    if (type >= NUM_TYPES) return 0;
+
+    size_t data_bytes = data_count *
+            camera_metadata_type_size[type];
+
+    return data_bytes <= 4 ? 0 : ALIGN_TO(data_bytes, DATA_ALIGNMENT);
+}
+
 int validate_camera_metadata_structure(const camera_metadata_t *metadata,
                                        const size_t *expected_size) {
 
@@ -363,6 +396,14 @@
         return ERROR;
     }
 
+    if (metadata->data_count > metadata->data_capacity) {
+        ALOGE("%s: Data count (%" PRIu32 ") should be <= data capacity "
+              "(%" PRIu32 ")",
+              __FUNCTION__, metadata->data_count, metadata->data_capacity);
+        android_errorWriteLog(SN_EVENT_LOG_ID, "30591838");
+        return ERROR;
+    }
+
     const metadata_uptrdiff_t entries_end =
         metadata->entries_start + metadata->entry_capacity;
     if (entries_end < metadata->entries_start || // overflow check
@@ -420,9 +461,13 @@
             return ERROR;
         }
 
-        size_t data_size =
-                calculate_camera_metadata_entry_data_size(entry.type,
-                                                          entry.count);
+        size_t data_size;
+        if (validate_and_calculate_camera_metadata_entry_data_size(&data_size, entry.type,
+                entry.count) != OK) {
+            ALOGE("%s: Entry data size is invalid. type: %u count: %u", __FUNCTION__, entry.type,
+                    entry.count);
+            return ERROR;
+        }
 
         if (data_size != 0) {
             camera_metadata_data_t *data =
@@ -465,6 +510,10 @@
         const camera_metadata_t *src) {
     if (dst == NULL || src == NULL ) return ERROR;
 
+    // Check for overflow
+    if (src->entry_count + dst->entry_count < src->entry_count) return ERROR;
+    if (src->data_count + dst->data_count < src->data_count) return ERROR;
+    // Check for space
     if (dst->entry_capacity < src->entry_count + dst->entry_count) return ERROR;
     if (dst->data_capacity < src->data_count + dst->data_count) return ERROR;
 
@@ -514,14 +563,6 @@
     return clone;
 }
 
-size_t calculate_camera_metadata_entry_data_size(uint8_t type,
-        size_t data_count) {
-    if (type >= NUM_TYPES) return 0;
-    size_t data_bytes = data_count *
-            camera_metadata_type_size[type];
-    return data_bytes <= 4 ? 0 : ALIGN_TO(data_bytes, DATA_ALIGNMENT);
-}
-
 static int add_camera_metadata_entry_raw(camera_metadata_t *dst,
         uint32_t tag,
         uint8_t  type,