A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

ASoC: correct read size return value for erroneous conditions

Browse source 
Wrong return value of in_read() causes integer overflow in omx,
which aborts the process. Correct the return value for erroneous
conditions.

CRs-Fixed: 2336645
Change-Id: Ib01827adc92700876f3b11816857f0086b1b5f94
Signed-off-by: Weiyin Jiang <wjiang@codeaurora.org>
This commit is contained in:
Weiyin Jiang 2018-10-22 16:40:10 +08:00
commit 4e6bb44f61
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
dsp/codecs/audio_utils.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
/* Copyright (c) 2010-2018, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -760,6 +760,10 @@ ssize_t audio_in_read(struct file *file,
}
bytes_to_copy =
(size + audio->out_frame_info[idx][1]);
if (bytes_to_copy == 0) {
rc = 0;
break;
}
/* Number of frames information copied */
buf += sizeof(unsigned char);
count -= sizeof(unsigned char);
@ -793,8 +797,10 @@ ssize_t audio_in_read(struct file *file,
pr_debug("%s:session id %d: read: %zd bytes\n", __func__,
audio->ac->session, (buf-start));
if (buf > start)
return buf - start;
if (!rc) {
if (buf > start)
return buf - start;
}
return rc;
}