From 4e6bb44f611bb81201be4b10b4bc18115fdd2c33 Mon Sep 17 00:00:00 2001 From: Weiyin Jiang Date: Mon, 22 Oct 2018 16:40:10 +0800 Subject: [PATCH] ASoC: correct read size return value for erroneous conditions Wrong return value of in_read() causes integer overflow in omx, which aborts the process. Correct the return value for erroneous conditions. CRs-Fixed: 2336645 Change-Id: Ib01827adc92700876f3b11816857f0086b1b5f94 Signed-off-by: Weiyin Jiang --- dsp/codecs/audio_utils.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/dsp/codecs/audio_utils.c b/dsp/codecs/audio_utils.c index 15ee9f51a7d8..e55967841fa6 100644 --- a/dsp/codecs/audio_utils.c +++ b/dsp/codecs/audio_utils.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2010-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -760,6 +760,10 @@ ssize_t audio_in_read(struct file *file, } bytes_to_copy = (size + audio->out_frame_info[idx][1]); + if (bytes_to_copy == 0) { + rc = 0; + break; + } /* Number of frames information copied */ buf += sizeof(unsigned char); count -= sizeof(unsigned char); @@ -793,8 +797,10 @@ ssize_t audio_in_read(struct file *file, pr_debug("%s:session id %d: read: %zd bytes\n", __func__, audio->ac->session, (buf-start)); - if (buf > start) - return buf - start; + if (!rc) { + if (buf > start) + return buf - start; + } return rc; }