Commit message: None
CVE: CVE-2017-0402
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32436341.

Project: Android

int equalizer_disable(effect_context_t *context)
{
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;

    ALOGV("%s", __func__);
 if (offload_eq_get_enable_flag(&(eq_ctxt->offload_eq))) {
        offload_eq_set_enable_flag(&(eq_ctxt->offload_eq), false);
 if (eq_ctxt->ctl)
            offload_eq_send_params(eq_ctxt->ctl, &eq_ctxt->offload_eq,
                                   OFFLOAD_SEND_EQ_ENABLE_FLAG);
 }
 return 0;
}

Project: Android

int equalizer_enable(effect_context_t *context)
{
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;

    ALOGV("%s", __func__);

 if (!offload_eq_get_enable_flag(&(eq_ctxt->offload_eq))) {
        offload_eq_set_enable_flag(&(eq_ctxt->offload_eq), true);
 if (eq_ctxt->ctl)
            offload_eq_send_params(eq_ctxt->ctl, &eq_ctxt->offload_eq,
                                   OFFLOAD_SEND_EQ_ENABLE_FLAG |
                                   OFFLOAD_SEND_EQ_BANDS_LEVEL);
 }
 return 0;
}

Project: Android

int equalizer_get_band(equalizer_context_t *context __unused, uint32_t freq)
{
 int i;

    ALOGV("%s: freq: %d", __func__, freq);
 for (i = 0; i < NUM_EQ_BANDS; i++) {
 if (freq <= equalizer_band_freq_range[i][1]) {
 return i;
 }
 }
 return NUM_EQ_BANDS - 1;
}

Project: Android

int equalizer_get_band_freq_range(equalizer_context_t *context __unused, int32_t band,
 uint32_t *low, uint32_t *high)
{
    ALOGV("%s: band: %d", __func__, band);
 *low = equalizer_band_freq_range[band][0];
 *high = equalizer_band_freq_range[band][1];
 return 0;
}

Project: Android

int equalizer_get_band_level(equalizer_context_t *context, int32_t band)
{
    ALOGV("%s: band: %d level: %d", __func__, band,
           context->band_levels[band] * 100);
 return context->band_levels[band] * 100;
}

Project: Android

int equalizer_get_center_frequency(equalizer_context_t *context __unused, int32_t band)
{
    ALOGV("%s: band: %d", __func__, band);
 return (equalizer_band_freq_range[band][0] +
            equalizer_band_freq_range[band][1]) / 2;
}

Project: Android

int equalizer_get_num_presets(equalizer_context_t *context __unused)
{
    ALOGV("%s: presets_num: %d", __func__,
 sizeof(equalizer_preset_names)/sizeof(char *));
 return sizeof(equalizer_preset_names)/sizeof(char *);
}

Project: Android

int equalizer_get_preset(equalizer_context_t *context)
{
    ALOGV("%s: preset: %d", __func__, context->preset);
 return context->preset;
}

Project: Android

const char * equalizer_get_preset_name(equalizer_context_t *context __unused,
 int32_t preset)
{
    ALOGV("%s: preset: %s", __func__, equalizer_preset_names[preset]);
 if (preset == PRESET_CUSTOM) {
 return "Custom";
 } else {
 return equalizer_preset_names[preset];
 }
}

Project: Android

int equalizer_init(effect_context_t *context)
{
    ALOGV("%s", __func__);
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;

    context->config.inputCfg.accessMode = EFFECT_BUFFER_ACCESS_READ;
    context->config.inputCfg.channels = AUDIO_CHANNEL_OUT_STEREO;
    context->config.inputCfg.format = AUDIO_FORMAT_PCM_16_BIT;
    context->config.inputCfg.samplingRate = 44100;
    context->config.inputCfg.bufferProvider.getBuffer = NULL;
    context->config.inputCfg.bufferProvider.releaseBuffer = NULL;
    context->config.inputCfg.bufferProvider.cookie = NULL;
    context->config.inputCfg.mask = EFFECT_CONFIG_ALL;
    context->config.outputCfg.accessMode = EFFECT_BUFFER_ACCESS_ACCUMULATE;
    context->config.outputCfg.channels = AUDIO_CHANNEL_OUT_STEREO;
    context->config.outputCfg.format = AUDIO_FORMAT_PCM_16_BIT;
    context->config.outputCfg.samplingRate = 44100;
    context->config.outputCfg.bufferProvider.getBuffer = NULL;
    context->config.outputCfg.bufferProvider.releaseBuffer = NULL;
    context->config.outputCfg.bufferProvider.cookie = NULL;
    context->config.outputCfg.mask = EFFECT_CONFIG_ALL;

    set_config(context, &context->config);

    memset(&(eq_ctxt->offload_eq), 0, sizeof(struct eq_params));
    offload_eq_set_preset(&(eq_ctxt->offload_eq), INVALID_PRESET);

 return 0;
}

Project: Android

int equalizer_reset(effect_context_t *context)
{
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;

 return 0;
}

Project: Android

int equalizer_set_band_level(equalizer_context_t *context, int32_t band,
 int32_t level)
{
    ALOGV("%s: band: %d, level: %d", __func__, band, level);
 if (level > 0) {
        level = (int)((level+50)/100);
 } else {
        level = (int)((level-50)/100);
 }
    context->band_levels[band] = level;
    context->preset = PRESET_CUSTOM;

    offload_eq_set_preset(&(context->offload_eq), PRESET_CUSTOM);
    offload_eq_set_bands_level(&(context->offload_eq),
                               NUM_EQ_BANDS,
                               equalizer_band_presets_freq,
                               context->band_levels);
 if (context->ctl)
        offload_eq_send_params(context->ctl, &context->offload_eq,
                               OFFLOAD_SEND_EQ_ENABLE_FLAG |
                               OFFLOAD_SEND_EQ_BANDS_LEVEL);
 return 0;
}

Project: Android

int equalizer_set_device(effect_context_t *context, uint32_t device)
{
    ALOGV("%s: device: %d", __func__, device);
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;
    eq_ctxt->device = device;
    offload_eq_set_device(&(eq_ctxt->offload_eq), device);
 return 0;
}

Project: Android

int equalizer_set_parameter(effect_context_t *context, effect_param_t *p,
 uint32_t size __unused)
{
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;
 int voffset = ((p->psize - 1) / sizeof(int32_t) + 1) * sizeof(int32_t);
 void *value = p->data + voffset;
 int32_t *param_tmp = (int32_t *)p->data;
 int32_t param = *param_tmp++;
 int32_t preset;
 int32_t band;
 int32_t level;
 int i;

    ALOGV("%s", __func__);

    p->status = 0;

 switch (param) {
 case EQ_PARAM_CUR_PRESET:
	ALOGV("EQ_PARAM_CUR_PRESET");
        preset = (int32_t)(*(uint16_t *)value);

 if ((preset >= equalizer_get_num_presets(eq_ctxt)) || (preset < 0)) {
           p->status = -EINVAL;
 break;
 }
        equalizer_set_preset(eq_ctxt, preset);
 break;
 case EQ_PARAM_BAND_LEVEL:
	ALOGV("EQ_PARAM_BAND_LEVEL");
        band = *param_tmp;
        level = (int32_t)(*(int16_t *)value);
 if (band >= NUM_EQ_BANDS) {
           p->status = -EINVAL;
 break;
 }
        equalizer_set_band_level(eq_ctxt, band, level);
 break;
 case EQ_PARAM_PROPERTIES: {
	ALOGV("EQ_PARAM_PROPERTIES");
 int16_t *prop = (int16_t *)value;
 if ((int)prop[0] >= equalizer_get_num_presets(eq_ctxt)) {
            p->status = -EINVAL;
 break;
 }
 if (prop[0] >= 0) {
            equalizer_set_preset(eq_ctxt, (int)prop[0]);
 } else {
 if ((int)prop[1] != NUM_EQ_BANDS) {
                p->status = -EINVAL;
 break;
 }
 for (i = 0; i < NUM_EQ_BANDS; i++) {
               equalizer_set_band_level(eq_ctxt, i, (int)prop[2 + i]);
 }
 }
 } break;
 default:
        p->status = -EINVAL;
 break;
 }

 return 0;
}

Project: Android

int equalizer_set_preset(equalizer_context_t *context, int preset)
{
 int i;

    ALOGV("%s: preset: %d", __func__, preset);
    context->preset = preset;
 for (i=0; i<NUM_EQ_BANDS; i++)
        context->band_levels[i] =
                 equalizer_band_presets_level[i + preset * NUM_EQ_BANDS];

    offload_eq_set_preset(&(context->offload_eq), preset);
    offload_eq_set_bands_level(&(context->offload_eq),
                               NUM_EQ_BANDS,
                               equalizer_band_presets_freq,
                               context->band_levels);
 if(context->ctl)
        offload_eq_send_params(context->ctl, &context->offload_eq,
                               OFFLOAD_SEND_EQ_ENABLE_FLAG |
                               OFFLOAD_SEND_EQ_PRESET);
 return 0;
}

Project: Android

int equalizer_start(effect_context_t *context, output_context_t *output)
{
 equalizer_context_t *eq_ctxt = (equalizer_context_t *)context;

    ALOGV("%s: %p", __func__, output->ctl);
    eq_ctxt->ctl = output->ctl;
 if (offload_eq_get_enable_flag(&(eq_ctxt->offload_eq)))
 if (eq_ctxt->ctl)
            offload_eq_send_params(eq_ctxt->ctl, &eq_ctxt->offload_eq,
                                   OFFLOAD_SEND_EQ_ENABLE_FLAG |
                                   OFFLOAD_SEND_EQ_BANDS_LEVEL);
 return 0;
}