A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 12:25:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: q6voice: Add buf size check for cvp cal data

Browse source 
Check for the max size of cvp command register
calibration data that can be copied to avoid
buffer overflow.

Change-Id: I41793bef75095ef06d7dda171bd2eba158422cc9
Signed-off-by: Shimana P <quic_shimp@quicinc.com>
This commit is contained in:
Shimana P 2024-07-24 12:55:49 +05:30
commit a7a8049215
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
dsp/q6voice.c
View file

@ -3322,6 +3322,13 @@ static int voice_send_cvp_register_cal_cmd(struct voice_data *v)
voc_get_session_name(v->session_id), v->dev_tx.dev_id,
v->dev_rx.dev_id);
if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {
pr_err("%s: Invalid cal data size %d!\n",
__func__, col_data->cal_data.size);
ret = -EINVAL;
goto unlock;
}
memcpy(&cvp_reg_cal_cmd.cvp_cal_data.column_info[0],
(void *) &((struct audio_cal_info_voc_col *)
col_data->cal_info)->data,
@ -3519,6 +3526,13 @@ static int voice_send_cvp_register_vol_cal_cmd(struct voice_data *v)
goto unlock;
}
if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {
pr_err("%s: Invalid cal data size %d!\n",
__func__, col_data->cal_data.size);
ret = -EINVAL;
goto unlock;
}
memcpy(&cvp_reg_vol_cal_cmd.cvp_vol_cal_data.column_info[0],
(void *) &((struct audio_cal_info_voc_col *)
col_data->cal_info)->data,