diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-03-14 02:07:48 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-03-14 02:07:47 -0700 |
| commit | 032f9c9018b968ec5b20195660f85e3c1c104e1c (patch) | |
| tree | 9b03fcedb7beba96860c66bc09cce886889fbd14 | |
| parent | 7a9806a85bb5b63d18a0387ae1f01e01d8b2bd7b (diff) | |
| parent | db3b23f94285456b856e6dfd84d13133760419f4 (diff) | |
Merge "dsp: q6voice: Check size of shared memory buffer before access"
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6voice.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/q6voice.c b/sound/soc/msm/qdsp6v2/q6voice.c index 914c63998747..eb635243dd5a 100644 --- a/sound/soc/msm/qdsp6v2/q6voice.c +++ b/sound/soc/msm/qdsp6v2/q6voice.c @@ -6793,6 +6793,11 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data; if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) { + if (v->shmem_info.sh_buf.buf[1].size < + ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) { + pr_err("%s: invalid voc pkt size\n", __func__); + return -EINVAL; + } /* cvs_voc_pkt[0] contains tx timestamp */ common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3], cvs_voc_pkt[2], |