A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 12:25:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Fix for OOB access issue

Browse source 
Added payload size check to avoid OOB read issues.

Change-Id: I4f15bdfdcf15e388ebc49dd0e8cf7a99ed03d0d5
Signed-off-by: Kumar Anurag Singh <quic_kumaranu@quicinc.com>
This commit is contained in:
Kumar Anurag Singh 2024-04-04 21:27:36 -07:00
commit fb09ec8587
1 changed files with 5 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

15
dsp/q6adm.c
View file

@ -1713,16 +1713,11 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
if (data->opcode == APR_BASIC_RSP_RESULT) {
pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n",
__func__, payload[0]);
if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) &&
((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) ||
(payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) {
if (data->payload_size <
(2 * sizeof(uint32_t))) {
pr_err("%s: Invalid payload size %d\n",
__func__, data->payload_size);
return 0;
}
if (data->payload_size <
(2 * sizeof(uint32_t))) {
pr_err("%s: Invalid payload size %d\n",
__func__, data->payload_size);
return 0;
}
if (payload[1] != 0) {