A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: q6core: validate payload size before access for AVCS

Browse source 
Payload size is not checked before payload access for AVCS.
Check size to avoid out-of-boundary memory access.

Change-Id: I6de3342617bd4f3fb8849ad2230dd57c07469372
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
This commit is contained in:
Shalini Manjunatha 2023-04-17 16:49:39 +05:30 • committed by Gerrit - the friendly Code Review server
commit 1d75d0dcb6
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
dsp/q6core.c
View file

@ -474,6 +474,12 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
case AVCS_CMD_RSP_LOAD_MODULES:
pr_debug("%s: Received AVCS_CMD_RSP_LOAD_MODULES\n",
__func__);
if (data->payload_size != ((sizeof(struct avcs_load_unload_modules_sec_payload)
* rsp_payload->num_modules) + sizeof(uint32_t))) {
pr_err("%s: payload size greater than expected size %d\n",
__func__,data->payload_size);
return -EINVAL;
}
memcpy(rsp_payload, data->payload, data->payload_size);
q6core_lcl.avcs_module_resp_received = 1;
wake_up(&q6core_lcl.avcs_module_load_unload_wait);
@ -1036,6 +1042,8 @@ int32_t q6core_avcs_load_unload_modules(struct avcs_load_unload_modules_payload
return -ENOMEM;
}
rsp_payload->num_modules = num_modules;
memcpy((uint8_t *)mod + sizeof(struct apr_hdr) +
sizeof(struct avcs_load_unload_modules_meminfo),
payload, payload_size);