A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: update size check for get VI param function

Browse source 
In afe_get_cal_sp_th_vi_param functions, data size
should check with size of cal_type_header. The check
is not present which might lead to out of bounds access.

Update condition to ensure data_size is greater than
or equal to size of cal_type_header.

Change-Id: Ib2904f53243f4fb858131511812fd90de32b4656
Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>
This commit is contained in:
Kunlei Zhang 2021-02-24 11:25:41 +08:00
commit 7a4d8574ec
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
dsp/q6afe.c
View file

@ -10860,6 +10860,7 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size,
if (cal_data == NULL ||
data_size > sizeof(*cal_data) ||
data_size < sizeof(cal_data->cal_hdr) ||
this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)
return 0;
@ -10888,7 +10889,8 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size,
pr_debug("%s: cal_type = %d\n", __func__, cal_type);
if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL ||
cal_data == NULL ||
data_size != sizeof(*cal_data))
data_size > sizeof(*cal_data) ||
data_size < sizeof(cal_data->cal_hdr))
goto done;
mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock);
@ -10955,7 +10957,8 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size,
pr_debug("%s: cal_type = %d\n", __func__, cal_type);
if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL ||
cal_data == NULL ||
data_size != sizeof(*cal_data))
data_size > sizeof(*cal_data) ||
data_size < sizeof(cal_data->cal_hdr))
goto done;
mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock);