From 2e285bf25d018dc9b304a9090bb443305c4065b3 Mon Sep 17 00:00:00 2001 From: Ajit Pandey Date: Mon, 26 Aug 2019 16:06:51 +0530 Subject: [PATCH] dsp: avtimer: validate payload size before memory copy Check payload size to avoid out-of-boundary memory access before attemptimg memory read. Change-Id: I94723b526449aacfe7b2fe30990fb77cdd15c5da Signed-off-by: Ajit Pandey --- dsp/avtimer.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/dsp/avtimer.c b/dsp/avtimer.c index 8d9402c91730..39b5268ef78e 100644 --- a/dsp/avtimer.c +++ b/dsp/avtimer.c @@ -89,6 +89,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) } payload1 = data->payload; + + if (data->payload_size < 2 * sizeof(uint32_t)) { + pr_err("%s: payload has invalid size %d\n", + __func__, data->payload_size); + return -EINVAL; + } + switch (payload1[0]) { case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST: pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n", @@ -114,6 +121,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) } case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST: + if (data->payload_size < sizeof(uint32_t)) { + pr_err("%s: payload has invalid size %d\n", + __func__, data->payload_size); + return -EINVAL; + } payload1 = data->payload; pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n", __func__, payload1[0]);