From 7db940a090a27a749678221e7bc87fc18f187779 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 10 Apr 2023 15:28:02 +0530 Subject: [PATCH] dsp: afe: Add check for sidetone iir config copy size Avoid OOB access of sidetone iir config array when iir_num_biquad_stages returned from cal block is > 10 Change-Id: I45b95e8bdd1a993a526590c94cf2f9a85c12af37 Signed-off-by: Soumya Managoli --- dsp/q6afe.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/dsp/q6afe.c b/dsp/q6afe.c index a08843a74d31..ccd0b349d66e 100644 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -8652,6 +8652,14 @@ static int afe_sidetone_iir(u16 tx_port_id) pr_debug("%s: adding 2 to size:%d\n", __func__, size); size = size + 2; } + + if (size > MAX_SIDETONE_IIR_DATA_SIZE) { + pr_err("%s: iir_config size is out of bounds:%d\n", __func__, size); + mutex_unlock(&this_afe.cal_data[cal_index]->lock); + ret = -EINVAL; + goto done; + } + memcpy(&filter_data.iir_config, &st_iir_cal_info->iir_config, size); mutex_unlock(&this_afe.cal_data[cal_index]->lock);