A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: fix out of bound access for cal_data size

Browse source 
Add change to fix cal_data index out of bounds error.

Change-Id: I8c8e62835e496c0f35fdc09757f4206c52020727
Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>
This commit is contained in:
Kunlei Zhang 2021-05-11 14:56:29 +08:00
commit 2e32fdc94e
1 changed files with 2 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
dsp/q6afe.c
View file

@ -11259,8 +11259,7 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size,
pr_debug("%s: cal_type = %d\n", __func__, cal_type);
if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL ||
cal_data == NULL ||
data_size > sizeof(*cal_data) ||
data_size < sizeof(cal_data->cal_hdr))
data_size != sizeof(*cal_data))
goto done;
mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock);
@ -11327,8 +11326,7 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size,
pr_debug("%s: cal_type = %d\n", __func__, cal_type);
if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL ||
cal_data == NULL ||
data_size > sizeof(*cal_data) ||
data_size < sizeof(cal_data->cal_hdr))
data_size != sizeof(*cal_data))
goto done;
mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock);