From 1d75d0dcb6f1afeab757e1b331179ff69b6838e9 Mon Sep 17 00:00:00 2001 From: Shalini Manjunatha Date: Mon, 17 Apr 2023 16:49:39 +0530 Subject: [PATCH] dsp: q6core: validate payload size before access for AVCS Payload size is not checked before payload access for AVCS. Check size to avoid out-of-boundary memory access. Change-Id: I6de3342617bd4f3fb8849ad2230dd57c07469372 Signed-off-by: Shalini Manjunatha --- dsp/q6core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dsp/q6core.c b/dsp/q6core.c index 2fce87998485..441c15c7a717 100644 --- a/dsp/q6core.c +++ b/dsp/q6core.c @@ -474,6 +474,12 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) case AVCS_CMD_RSP_LOAD_MODULES: pr_debug("%s: Received AVCS_CMD_RSP_LOAD_MODULES\n", __func__); + if (data->payload_size != ((sizeof(struct avcs_load_unload_modules_sec_payload) + * rsp_payload->num_modules) + sizeof(uint32_t))) { + pr_err("%s: payload size greater than expected size %d\n", + __func__,data->payload_size); + return -EINVAL; + } memcpy(rsp_payload, data->payload, data->payload_size); q6core_lcl.avcs_module_resp_received = 1; wake_up(&q6core_lcl.avcs_module_load_unload_wait); @@ -1036,6 +1042,8 @@ int32_t q6core_avcs_load_unload_modules(struct avcs_load_unload_modules_payload return -ENOMEM; } + rsp_payload->num_modules = num_modules; + memcpy((uint8_t *)mod + sizeof(struct apr_hdr) + sizeof(struct avcs_load_unload_modules_meminfo), payload, payload_size);