Code:  int PreProcessingFx_ProcessReverse(effect_handle_t     self,
                                    audio_buffer_t    *inBuffer,
                                   audio_buffer_t    *outBuffer)
 {
     preproc_effect_t * effect = (preproc_effect_t *)self;
     int    status = 0;

 if (effect == NULL){
        ALOGW("PreProcessingFx_ProcessReverse() ERROR effect == NULL");
 return -EINVAL;
 }
 preproc_session_t * session = (preproc_session_t *)effect->session;

 if (inBuffer == NULL  || inBuffer->raw == NULL){
        ALOGW("PreProcessingFx_ProcessReverse() ERROR bad pointer");
 return -EINVAL;
 }

    session->revProcessedMsk |= (1<<effect->procId);



 if ((session->revProcessedMsk & session->revEnabledMsk) == session->revEnabledMsk) {
        effect->session->revProcessedMsk = 0;
 if (session->revResampler != NULL) {
 size_t fr = session->frameCount - session->framesRev;
 if (inBuffer->frameCount < fr) {
                fr = inBuffer->frameCount;
 }
 if (session->revBufSize < session->framesRev + fr) {
                session->revBufSize = session->framesRev + fr;
                session->revBuf = (int16_t *)realloc(session->revBuf,
                                  session->revBufSize * session->inChannelCount * sizeof(int16_t));
 }
            memcpy(session->revBuf + session->framesRev * session->inChannelCount,
                   inBuffer->s16,
                   fr * session->inChannelCount * sizeof(int16_t));

            session->framesRev += fr;
            inBuffer->frameCount = fr;
 if (session->framesRev < session->frameCount) {
 return 0;
 }
 spx_uint32_t frIn = session->framesRev;
 spx_uint32_t frOut = session->apmFrameCount;
 if (session->inChannelCount == 1) {
                speex_resampler_process_int(session->revResampler,
 0,
                                            session->revBuf,
 &frIn,
                                            session->revFrame->_payloadData,
 &frOut);
 } else {
                speex_resampler_process_interleaved_int(session->revResampler,
                                                        session->revBuf,
 &frIn,
                                                        session->revFrame->_payloadData,
 &frOut);
 }
            memcpy(session->revBuf,
                   session->revBuf + frIn * session->inChannelCount,
 (session->framesRev - frIn) * session->inChannelCount * sizeof(int16_t));
            session->framesRev -= frIn;
 } else {
 size_t fr = session->frameCount - session->framesRev;
 if (inBuffer->frameCount < fr) {
                fr = inBuffer->frameCount;
 }
            memcpy(session->revFrame->_payloadData + session->framesRev * session->inChannelCount,
                   inBuffer->s16,
                   fr * session->inChannelCount * sizeof(int16_t));
            session->framesRev += fr;
            inBuffer->frameCount = fr;
 if (session->framesRev < session->frameCount) {
 return 0;
 }
            session->framesRev = 0;
 }
        session->revFrame->_payloadDataLengthInSamples =
                session->apmFrameCount * session->inChannelCount;
        effect->session->apm->AnalyzeReverseStream(session->revFrame);
 return 0;
 } else {
 return -ENODATA;
 }
}

Vulnerability Type: Exec Code Overflow 
CWE ID: CWE-119
Summary: Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application, aka internal bug 21953516.
Commit Message: audio effects: fix heap overflow

Check consistency of effect command reply sizes before
copying to reply address.

Also add null pointer check on reply size.
Also remove unused parameter warning.

Bug: 21953516.
Change-Id: I4cf00c12eaed696af28f3b7613f7e36f47a160c4
(cherry picked from commit 0f714a464d2425afe00d6450535e763131b40844)
