From 2e32fdc94e39f6ed81e8d45f393863510d05da73 Mon Sep 17 00:00:00 2001 From: Kunlei Zhang Date: Tue, 11 May 2021 14:56:29 +0800 Subject: [PATCH] dsp: fix out of bound access for cal_data size Add change to fix cal_data index out of bounds error. Change-Id: I8c8e62835e496c0f35fdc09757f4206c52020727 Signed-off-by: Kunlei Zhang --- dsp/q6afe.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/dsp/q6afe.c b/dsp/q6afe.c index ac6bc11733b5..0402c15149e3 100755 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -11259,8 +11259,7 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL || cal_data == NULL || - data_size > sizeof(*cal_data) || - data_size < sizeof(cal_data->cal_hdr)) + data_size != sizeof(*cal_data)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock); @@ -11327,8 +11326,7 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL || cal_data == NULL || - data_size > sizeof(*cal_data) || - data_size < sizeof(cal_data->cal_hdr)) + data_size != sizeof(*cal_data)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock);