A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "ASoC: msm-pcm-host-voice: Address buffer overflow in hpcm playback copy"

Browse source
This commit is contained in:
qctecmdr 2023-06-01 12:27:25 -07:00 • committed by Gerrit - the friendly Code Review server
commit e9cdb60d7b
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
asoc/msm-pcm-host-voice-v2.c
View file

@ -663,6 +663,13 @@ static void hpcm_copy_playback_data_from_queue(struct dai_data *dai_data,
struct hpcm_buf_node, list);
list_del(&buf_node->list);
*len = buf_node->frame.len;
if (*len > HPCM_MAX_VOC_PKT_SIZE) {
pr_err("%s: Playback data len %d overflow\n",
__func__, *len);
return;
}
memcpy((u8 *)dai_data->vocpcm_ion_buffer.kvaddr,
&buf_node->frame.voc_pkt[0],
buf_node->frame.len);
@ -690,8 +697,8 @@ static void hpcm_copy_capture_data_to_queue(struct dai_data *dai_data,
if (dai_data->substream == NULL)
return;
if (len >= HPCM_MAX_VOC_PKT_SIZE) {
pr_err("%s: Copy capture data len %d is > HPCM_MAX_VOC_PKT_SIZE\n",
if (len > HPCM_MAX_VOC_PKT_SIZE) {
pr_err("%s: Copy capture data len %d overflow\n",
__func__, len);
return;
}