mixer: check for overflow and NULL returnandroid-cts-7.0_r9android-cts-7.0_r8android-cts-7.0_r7android-cts-7.0_r6android-cts-7.0_r5android-cts-7.0_r4android-cts-7.0_r33android-cts-7.0_r32android-cts-7.0_r31android-cts-7.0_r30android-cts-7.0_r3android-cts-7.0_r29android-cts-7.0_r28android-cts-7.0_r27android-cts-7.0_r26android-cts-7.0_r25android-cts-7.0_r24android-cts-7.0_r23android-cts-7.0_r22android-cts-7.0_r21android-cts-7.0_r20android-cts-7.0_r2android-cts-7.0_r19android-cts-7.0_r18android-cts-7.0_r17android-cts-7.0_r16android-cts-7.0_r15android-cts-7.0_r14android-cts-7.0_r13android-cts-7.0_r12android-cts-7.0_r11android-cts-7.0_r10android-cts-7.0_r1android-7.0.0_r9android-7.0.0_r8android-7.0.0_r7android-7.0.0_r6android-7.0.0_r5android-7.0.0_r4android-7.0.0_r36android-7.0.0_r35android-7.0.0_r34android-7.0.0_r33android-7.0.0_r32android-7.0.0_r31android-7.0.0_r30android-7.0.0_r3android-7.0.0_r29android-7.0.0_r28android-7.0.0_r27android-7.0.0_r24android-7.0.0_r21android-7.0.0_r19android-7.0.0_r17android-7.0.0_r15android-7.0.0_r14android-7.0.0_r13android-7.0.0_r12android-7.0.0_r11android-7.0.0_r10android-7.0.0_r1nougat-releasenougat-mr0.5-releasenougat-devnougat-cts-releasenougat-bugfix-release

Change-Id: Ia3439ab17cce8a3c5aa2a8ce3cfa32a39b935d88
Signed-off-by: Ben Zhang <benzh@google.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/mixer.c b/mixer.c
index 4b3d14f..c4e6765 100644
--- a/mixer.c
+++ b/mixer.c
@@ -28,6 +28,7 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdint.h>
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
@@ -360,7 +361,11 @@ int mixer_ctl_get_array(struct mixer_ctl *ctl, void *array, size_t count)
             struct snd_ctl_tlv *tlv;
             int ret;
 
+            if (count > SIZE_MAX - sizeof(*tlv))
+                return -EINVAL;
             tlv = calloc(1, sizeof(*tlv) + count);
+            if (!tlv)
+                return -ENOMEM;
             tlv->numid = ctl->info->id.numid;
             tlv->length = count;
             ret = ioctl(ctl->mixer->fd, SNDRV_CTL_IOCTL_TLV_READ, tlv);
@@ -456,7 +461,11 @@ int mixer_ctl_set_array(struct mixer_ctl *ctl, const void *array, size_t count)
         if (ctl->info->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE) {
             struct snd_ctl_tlv *tlv;
             int ret = 0;
+            if (count > SIZE_MAX - sizeof(*tlv))
+                return -EINVAL;
             tlv = calloc(1, sizeof(*tlv) + count);
+            if (!tlv)
+                return -ENOMEM;
             tlv->numid = ctl->info->id.numid;
             tlv->length = count;
             memcpy(tlv->tlv, array, count);