From eca1a399c4d4d372762ca512c6cf6b78c7d17fe4 Mon Sep 17 00:00:00 2001 From: Karthikeyan Mani Date: Tue, 15 Jan 2019 16:36:08 -0800 Subject: [PATCH] ipc: apr: check for packet size to header size comparison Check if packet size is large enough to hold the header. Change-Id: I7261f8111d8b5f4f7c181e469de248a732242d64 Signed-off-by: Karthikeyan Mani --- ipc/apr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ipc/apr.c b/ipc/apr.c index ec05d3b15cdc..2e6d75f3eb6f 100644 --- a/ipc/apr.c +++ b/ipc/apr.c @@ -636,6 +636,12 @@ void apr_cb_func(void *buf, int len, void *priv) pr_err("APR: Wrong paket size\n"); return; } + + if (hdr->pkt_size < hdr_size) { + pr_err("APR: Packet size less than header size\n"); + return; + } + msg_type = hdr->hdr_field; msg_type = (msg_type >> 0x08) & 0x0003; if (msg_type >= APR_MSG_TYPE_MAX && msg_type != APR_BASIC_RSP_RESULT) {