A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

ASoC: msm-pcm-host-voice: Address buffer overflow in hpcm capture copy

Browse source 
There is no check for the copy data size of the
ADSP returned payload. Add check for the max
hpcm_buf_node size before copy to avoid
buffer out of bounds issue.

Change-Id: Id647888430ce302359a857ef54d321bee99889bf
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
This commit is contained in:
Soumya Managoli 2023-04-12 14:27:28 +05:30
commit 7756692d54
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
asoc/msm-pcm-host-voice-v2.c
View file

@ -683,6 +683,12 @@ static void hpcm_copy_capture_data_to_queue(struct dai_data *dai_data,
if (dai_data->substream == NULL)
return;
if (len >= HPCM_MAX_VOC_PKT_SIZE) {
pr_err("%s: Copy capture data len %d is > HPCM_MAX_VOC_PKT_SIZE\n",
__func__, len);
return;
}
/* Copy out buffer packet into free_queue */
spin_lock_irqsave(&dai_data->dsp_lock, dsp_flags);