Code:  int LELib_Create(const effect_uuid_t *uuid,
                         int32_t sessionId,
                         int32_t ioId,
                          effect_handle_t *pHandle) {
     ALOGV("LELib_Create()");
     int ret;
 int i;

 if (pHandle == NULL || uuid == NULL) {
 return -EINVAL;
 }

 if (memcmp(uuid, &gLEDescriptor.uuid, sizeof(effect_uuid_t)) != 0) {
 return -EINVAL;
 }

 LoudnessEnhancerContext *pContext = new LoudnessEnhancerContext;

    pContext->mItfe = &gLEInterface;
    pContext->mState = LOUDNESS_ENHANCER_STATE_UNINITIALIZED;

    pContext->mCompressor = NULL;
    ret = LE_init(pContext);
 if (ret < 0) {
        ALOGW("LELib_Create() init failed");
 delete pContext;
 return ret;
 }

 *pHandle = (effect_handle_t)pContext;

    pContext->mState = LOUDNESS_ENHANCER_STATE_INITIALIZED;

    ALOGV("  LELib_Create context is %p", pContext);

 return 0;

}

Vulnerability Type: Exec Code Overflow 
CWE ID: CWE-119
Summary: Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application, aka internal bug 21953516.
Commit Message: audio effects: fix heap overflow

Check consistency of effect command reply sizes before
copying to reply address.

Also add null pointer check on reply size.
Also remove unused parameter warning.

Bug: 21953516.
Change-Id: I4cf00c12eaed696af28f3b7613f7e36f47a160c4
(cherry picked from commit 0f714a464d2425afe00d6450535e763131b40844)
