From fb09ec8587ea689fc274c0e1b9d096b55cea36c8 Mon Sep 17 00:00:00 2001 From: Kumar Anurag Singh Date: Thu, 4 Apr 2024 21:27:36 -0700 Subject: [PATCH] Fix for OOB access issue Added payload size check to avoid OOB read issues. Change-Id: I4f15bdfdcf15e388ebc49dd0e8cf7a99ed03d0d5 Signed-off-by: Kumar Anurag Singh --- dsp/q6adm.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/dsp/q6adm.c b/dsp/q6adm.c index 32a5b29d3a1c..7455252e2f08 100644 --- a/dsp/q6adm.c +++ b/dsp/q6adm.c @@ -1713,16 +1713,11 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) if (data->opcode == APR_BASIC_RSP_RESULT) { pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n", __func__, payload[0]); - - if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) && - ((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) || - (payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) { - if (data->payload_size < - (2 * sizeof(uint32_t))) { - pr_err("%s: Invalid payload size %d\n", - __func__, data->payload_size); - return 0; - } + if (data->payload_size < + (2 * sizeof(uint32_t))) { + pr_err("%s: Invalid payload size %d\n", + __func__, data->payload_size); + return 0; } if (payload[1] != 0) {