diff options
| author | Weiyin Jiang <wjiang@codeaurora.org> | 2016-04-26 14:35:38 +0800 |
|---|---|---|
| committer | Jeevan Shriram <jshriram@codeaurora.org> | 2016-05-03 15:52:37 -0700 |
| commit | 9847f9ca84dfd7f3fb9ecb82274b4349cd09befb (patch) | |
| tree | 228ae288c695a12e1e118163c3547c7a440208c3 /drivers/misc | |
| parent | 4e023df9c5ed540fa57d9ea49421828729535181 (diff) | |
ASoC: msm: audio-effects: misc fixes in h/w accelerated effect
Adding memory copy size check and integer overflow check in h/w
accelerated effect driver.
Change-Id: I17d4cc0a38770f0c5067fa8047cd63e7bf085e48
CRs-Fixed: 1006609
Signed-off-by: Weiyin Jiang <wjiang@codeaurora.org>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c b/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c index c100c47d7641..5432ce83c9a2 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c +++ b/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -164,7 +164,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, pr_debug("%s: dec buf size: %d, num_buf: %d, enc buf size: %d, num_buf: %d\n", __func__, effects->config.output.buf_size, - effects->config.output.buf_size, + effects->config.output.num_buf, effects->config.input.buf_size, effects->config.input.num_buf); rc = q6asm_audio_client_buf_alloc_contiguous(IN, effects->ac, @@ -252,7 +252,8 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, bufptr = q6asm_is_cpu_buf_avail(IN, effects->ac, &size, &idx); if (bufptr) { - if (copy_from_user(bufptr, (void *)arg, + if ((effects->config.buf_cfg.output_len > size) || + copy_from_user(bufptr, (void *)arg, effects->config.buf_cfg.output_len)) { rc = -EFAULT; goto ioctl_fail; @@ -308,7 +309,8 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, rc = -EFAULT; goto ioctl_fail; } - if (copy_to_user((void *)arg, bufptr, + if ((effects->config.buf_cfg.input_len > size) || + copy_to_user((void *)arg, bufptr, effects->config.buf_cfg.input_len)) { rc = -EFAULT; goto ioctl_fail; |