soundtrigger: add size check on sound model and recogntion data

am: ef0c915184

Change-Id: I5453811eb579dddd599be15108bb114095e07a58

diff --cc services/soundtrigger/SoundTriggerHwService.cpp
index d3b67f6,596b23d..665672f
--- 1/services/soundtrigger/SoundTriggerHwService.cpp
--- 2/services/soundtrigger/SoundTriggerHwService.cpp
+++ b/services/soundtrigger/SoundTriggerHwService.cpp
@@@ -534,17 -534,23 +534,33 @@@ status_t SoundTriggerHwService::Module:
      struct sound_trigger_sound_model *sound_model =
              (struct sound_trigger_sound_model *)modelMemory->pointer();
  
+     size_t structSize;
+     if (sound_model->type == SOUND_MODEL_TYPE_KEYPHRASE) {
+         structSize = sizeof(struct sound_trigger_phrase_sound_model);
+     } else {
+         structSize = sizeof(struct sound_trigger_sound_model);
+     }
+ 
+     if (sound_model->data_offset < structSize ||
+            sound_model->data_size > (UINT_MAX - sound_model->data_offset) ||
+            modelMemory->size() < sound_model->data_offset ||
+            sound_model->data_size > (modelMemory->size() - sound_model->data_offset)) {
+         android_errorWriteLog(0x534e4554, "30148546");
+         ALOGE("loadSoundModel() data_size is too big");
+         return BAD_VALUE;
+     }
+ 
      AutoMutex lock(mLock);
 +
 +    if (mModels.size() >= mDescriptor.properties.max_sound_models) {
 +        if (mModels.size() == 0) {
 +            return INVALID_OPERATION;
 +        }
 +        ALOGW("loadSoundModel() max number of models exceeded %d making room for a new one",
 +              mDescriptor.properties.max_sound_models);
 +        unloadSoundModel_l(mModels.valueAt(0)->mHandle);
 +    }
 +
      status_t status = mHwDevice->load_sound_model(mHwDevice,
                                                    sound_model,
                                                    SoundTriggerHwService::soundModelCallback,