audio_route: fix possible segfault

* Mixers may not allocate memory to save their values if the type is not
  of bool, enum, or int. However we do not check the type when actually
  attempting to use the allocated memory, resulting in possibly writing
  into random memory.

Change-Id: I8e59c8e6211b7ea10bd128069378632e0ced27a5

1 files changed, 18 insertions, 0 deletions

diff --git a/audio_route/audio_route.c b/audio_route/audio_route.c
index 4a44907..a0b4f36 100644
--- a/audio_route/audio_route.c
+++ b/audio_route/audio_route.c
@@ -540,8 +540,17 @@ int audio_route_update_mixer(struct audio_route *ar)
 static void save_mixer_state(struct audio_route *ar)
 {
     unsigned int i;
+    struct mixer_ctl *ctl;
+    enum mixer_ctl_type type;
 
     for (i = 0; i < ar->num_mixer_ctls; i++) {
+        /* Skip unsupported types that are not supported yet in XML */
+        ctl = mixer_get_ctl(ar->mixer, i);
+        type = mixer_ctl_get_type(ctl);
+        if ((type != MIXER_CTL_TYPE_BOOL) && (type != MIXER_CTL_TYPE_INT) &&
+            (type != MIXER_CTL_TYPE_ENUM))
+            continue;
+
         memcpy(ar->mixer_state[i].reset_value, ar->mixer_state[i].new_value,
                ar->mixer_state[i].num_values * sizeof(int));
     }
@@ -551,9 +560,18 @@ static void save_mixer_state(struct audio_route *ar)
 void audio_route_reset(struct audio_route *ar)
 {
     unsigned int i;
+    struct mixer_ctl *ctl;
+    enum mixer_ctl_type type;
 
     /* load all of the saved values */
     for (i = 0; i < ar->num_mixer_ctls; i++) {
+        /* Skip unsupported types that are not supported yet in XML */
+        ctl = mixer_get_ctl(ar->mixer, i);
+        type = mixer_ctl_get_type(ctl);
+        if ((type != MIXER_CTL_TYPE_BOOL) && (type != MIXER_CTL_TYPE_INT) &&
+            (type != MIXER_CTL_TYPE_ENUM))
+            continue;
+
         memcpy(ar->mixer_state[i].new_value, ar->mixer_state[i].reset_value,
                ar->mixer_state[i].num_values * sizeof(int));
     }