From 7a4d8574eccdfdcb321773cc620d3af2ab8bb7d2 Mon Sep 17 00:00:00 2001 From: Kunlei Zhang Date: Wed, 24 Feb 2021 11:25:41 +0800 Subject: [PATCH] dsp: update size check for get VI param function In afe_get_cal_sp_th_vi_param functions, data size should check with size of cal_type_header. The check is not present which might lead to out of bounds access. Update condition to ensure data_size is greater than or equal to size of cal_type_header. Change-Id: Ib2904f53243f4fb858131511812fd90de32b4656 Signed-off-by: Kunlei Zhang --- dsp/q6afe.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dsp/q6afe.c b/dsp/q6afe.c index ccfc7d5ff847..b5c0c953ad5d 100644 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -10860,6 +10860,7 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size, if (cal_data == NULL || data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr) || this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL) return 0; @@ -10888,7 +10889,8 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL || cal_data == NULL || - data_size != sizeof(*cal_data)) + data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock); @@ -10955,7 +10957,8 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL || cal_data == NULL || - data_size != sizeof(*cal_data)) + data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock);