From c3b67277c613a8b4a809bf21d6fbf0f836ca384c Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 29 May 2023 14:12:05 +0530 Subject: [PATCH] ASoC: msm-pcm-voip: Avoid interger underflow There is no check for voip pkt pkt_len,if it contains the min required data. This can lead to integer underflow. Add check for the same. Change-Id: I40242429542b6c32a0e6c3bbe03975c244c2f61a Signed-off-by: Soumya Managoli --- asoc/msm-pcm-voip-v2.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/asoc/msm-pcm-voip-v2.c b/asoc/msm-pcm-voip-v2.c index c926fa4e3037..cb71831fd22b 100644 --- a/asoc/msm-pcm-voip-v2.c +++ b/asoc/msm-pcm-voip-v2.c @@ -368,7 +368,7 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, case MODE_AMR: { if (pkt_len <= DSP_FRAME_HDR_LEN) { pr_err("%s: pkt_len %d is < required len\n", - pkt_len); + __func__, pkt_len); spin_unlock_irqrestore(&prtd->dsp_ul_lock, dsp_flags); return; @@ -395,7 +395,7 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, case MODE_4GV_NW: { if (pkt_len <= DSP_FRAME_HDR_LEN) { pr_err("%s: pkt_len %d is < required len\n", - pkt_len); + __func__, pkt_len); spin_unlock_irqrestore(&prtd->dsp_ul_lock, dsp_flags); return; @@ -439,7 +439,7 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) { pr_err("%s: pkt_len %d is < required len\n", - pkt_len); + __func__, pkt_len); spin_unlock_irqrestore(&prtd->dsp_ul_lock, dsp_flags); return; @@ -479,6 +479,14 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, buf_node->frame.frm_hdr.timestamp = timestamp; voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN; + if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) { + pr_err("%s: pkt_len %d is < required len\n", + __func__, pkt_len); + spin_unlock_irqrestore(&prtd->dsp_ul_lock, + dsp_flags); + return; + } + /* There are two frames in the buffer. Length * of the second frame: */