A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase.

Browse source 
size = sizeof(p_info_32) + p_info_32.param_size;
This overflow issue may result heap overflow during copying the data:
memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));

The validation check is added so that heap overflow can be avoided.

Change-Id: I11dcbe7ebb33e349dfd9f347f3ef25bc781075fc
Signed-off-by: Raza Kamal <quic_razkam@quicinc.com>
This commit is contained in:
Raza Kamal 2023-12-04 15:33:09 +05:30
commit acb96a6c93
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
asoc/msm-lsm-client.c
View file

@ -2379,8 +2379,13 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
prtd->lsm_client->get_param_payload = NULL;
goto done;
}
if (__builtin_uadd_overflow(sizeof(p_info_32), p_info_32.param_size, &size)) {
pr_err("%s: param size exceeds limit of %u bytes.\n",
__func__, UINT_MAX);
err = -EINVAL;
goto done;
}
size = sizeof(p_info_32) + p_info_32.param_size;
param_info_rsp = kzalloc(size, GFP_KERNEL);
if (!param_info_rsp) {