A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

asoc: msm-routing: Fix array out of bounds issue.

Browse source 
It seems there is out of bound access chances for lsm_app_type_cfg
array within msm_routing_get_lsm_app_type_cfg_control() callback.
Added case check to return invalid value if user tries to exceed
maximum allocated size of array to avoid it.

Change-Id: Ied86e6c9a957255c55bb126a09741fbde429be32
Signed-off-by: Ajit Pandey <ajitp@codeaurora.org>
This commit is contained in:
Ajit Pandey 2019-09-06 10:51:02 +05:30
commit 248ce5678f
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
asoc/msm-pcm-routing-v2.c
View file

@ -21699,16 +21699,16 @@ static int msm_routing_put_lsm_app_type_cfg_control(
kcontrol->private_value)->shift;
int i = 0, j;
num_app_cfg_types = ucontrol->value.integer.value[i++];
memset(lsm_app_type_cfg, 0, MAX_APP_TYPES*
sizeof(struct msm_pcm_routing_app_type_data));
if (num_app_cfg_types > MAX_APP_TYPES) {
if (ucontrol->value.integer.value[0] > MAX_APP_TYPES) {
pr_err("%s: number of app types exceed the max supported\n",
__func__);
return -EINVAL;
}
num_app_cfg_types = ucontrol->value.integer.value[i++];
memset(lsm_app_type_cfg, 0, MAX_APP_TYPES*
sizeof(struct msm_pcm_routing_app_type_data));
for (j = 0; j < num_app_cfg_types; j++) {
lsm_app_type_cfg[j].app_type =
ucontrol->value.integer.value[i++];