A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:22:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: q6voice: Check size of shared memory buffer before access

Browse source 
Check buffer size in qdsp_cvs_callback before access in
ul_pkt.

Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
This commit is contained in:
Vatsal Bucha 2019-03-05 15:52:15 +05:30 • committed by Gerrit - the friendly Code Review server
commit 0714ffdfcb
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
dsp/q6voice.c
View file

@ -7740,6 +7740,11 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv)
cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) {
if (v->shmem_info.sh_buf.buf[1].size <
((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
pr_err("%s: invalid voc pkt size\n", __func__);
return -EINVAL;
}
/* cvs_voc_pkt[0] contains tx timestamp */
common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],
cvs_voc_pkt[2],