A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: avtimer: validate payload size before memory copy

Browse source 
Check payload size to avoid out-of-boundary memory
access before attemptimg memory read.

Change-Id: I94723b526449aacfe7b2fe30990fb77cdd15c5da
Signed-off-by: Ajit Pandey <ajitp@codeaurora.org>
This commit is contained in:
Ajit Pandey 2019-08-26 16:06:51 +05:30
commit 2e285bf25d
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
dsp/avtimer.c
View file

@ -89,6 +89,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
}
payload1 = data->payload;
if (data->payload_size < 2 * sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
switch (payload1[0]) {
case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
@ -114,6 +121,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
}
case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
if (data->payload_size < sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
payload1 = data->payload;
pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
__func__, payload1[0]);