From 1f73583a2dab4189836c3197678bf7e6a7bdb94b Mon Sep 17 00:00:00 2001 From: Kunlei Zhang Date: Thu, 20 May 2021 16:02:30 +0800 Subject: [PATCH] dsp: update size check for set/get VI param function In afe_set_cal_sp_th_vi_cfg and afe_get_cal_sp_th_vi_param functions, data size is not checked properly which might lead to out of bounds access. Add data_size check to avoid out of bounds access. Change-Id: Ibe049300c609d0d717309bccc65cac876ac075f7 Signed-off-by: Kunlei Zhang --- dsp/q6afe.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dsp/q6afe.c b/dsp/q6afe.c index ac6bc11733b5..88431714d903 100755 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -11013,6 +11013,9 @@ static int afe_set_cal_sp_th_vi_cfg(int32_t cal_type, size_t data_size, if (cal_data == NULL || data_size > sizeof(*cal_data) || + (data_size < sizeof(cal_data->cal_hdr) + + sizeof(cal_data->cal_data) + + sizeof(cal_data->cal_info.mode)) || this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL) goto done; @@ -11230,7 +11233,9 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size, if (cal_data == NULL || data_size > sizeof(*cal_data) || - data_size < sizeof(cal_data->cal_hdr) || + (data_size < sizeof(cal_data->cal_hdr) + + sizeof(cal_data->cal_data) + + sizeof(cal_data->cal_info.mode)) || this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL) return 0;