commit abbaa20d68b390dfbd10639d459d5233565dfad9
author qctecmdr <qctecmdr@localhost> Wed Sep 27 03:27:47 2023 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Wed Sep 27 03:27:47 2023 -0700
tree dda482d891a38876f423b43d1843e3dd6389cfd8
parent 5a334e4544d7214a43efe6f88ea6dcbc48f17b6f
parent fa457080056266e002a1d98aef0cdb70b688d22e

Merge "pal: ipc_client: Remove the payload resize during pal stream set param."

ipc/HwBinders/pal_ipc_client/src/pal_client_wrapper.cpp

diff --git a/ipc/HwBinders/pal_ipc_client/src/pal_client_wrapper.cpp b/ipc/HwBinders/pal_ipc_client/src/pal_client_wrapper.cpp
index 894da97..4f42240 100644
--- a/ipc/HwBinders/pal_ipc_client/src/pal_client_wrapper.cpp
+++ b/ipc/HwBinders/pal_ipc_client/src/pal_client_wrapper.cpp
@@ -713,8 +713,7 @@
         if (pal_client == nullptr)
             return ret;
 
-        hidl_vec<PalParamPayload> paramPayload;
-        paramPayload.resize(sizeof(PalParamPayload));
+        hidl_vec<PalParamPayload> paramPayload(1);
         paramPayload.data()->payload.resize(param_payload->payload_size);
         paramPayload.data()->size = param_payload->payload_size;
         memcpy(paramPayload.data()->payload.data(), param_payload->payload,

ipc/HwBinders/pal_ipc_server/src/pal_server_wrapper.cpp

diff --git a/ipc/HwBinders/pal_ipc_server/src/pal_server_wrapper.cpp b/ipc/HwBinders/pal_ipc_server/src/pal_server_wrapper.cpp
index 1896d31..3381842 100644
--- a/ipc/HwBinders/pal_ipc_server/src/pal_server_wrapper.cpp
+++ b/ipc/HwBinders/pal_ipc_server/src/pal_server_wrapper.cpp
@@ -825,6 +825,14 @@
 {
     int32_t ret = 0;
     pal_param_payload *param_payload;
+    if (1 != paramPayload.size()) {
+        ALOGE("Invalid vector size");
+        return -EINVAL;
+    }
+    if (paramPayload.data()->size > paramPayload.data()->payload.size()) {
+        ALOGE("Invalid payload size");
+        return -EINVAL;
+    }
     param_payload = (pal_param_payload *)calloc (1,
                                     sizeof(pal_param_payload) + paramPayload.data()->size);
     if (!param_payload) {