diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-03-11 05:14:41 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-03-11 05:14:40 -0700 |
| commit | dbf205bb11e2135bfe07587c1188f90218d5e292 (patch) | |
| tree | ec697f86f1635512f4f33e981e5e996ee7ff2cab /drivers/soc | |
| parent | 255838278aa37c3900fe9be96c0bb2fb6a9106a9 (diff) | |
| parent | 6a1198af61cecc3f26f9b733ad2b6a777a7bba63 (diff) | |
Merge "qdsp6v2: apr: check for packet size to header size comparison"
Diffstat (limited to 'drivers/soc')
| -rw-r--r-- | drivers/soc/qcom/qdsp6v2/apr.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/soc/qcom/qdsp6v2/apr.c b/drivers/soc/qcom/qdsp6v2/apr.c index 9e55a25001ae..4bc1999485a7 100644 --- a/drivers/soc/qcom/qdsp6v2/apr.c +++ b/drivers/soc/qcom/qdsp6v2/apr.c @@ -601,6 +601,12 @@ void apr_cb_func(void *buf, int len, void *priv) pr_err("APR: Wrong paket size\n"); return; } + + if (hdr->pkt_size < hdr_size) { + pr_err("APR: Packet size less than header size\n"); + return; + } + msg_type = hdr->hdr_field; msg_type = (msg_type >> 0x08) & 0x0003; if (msg_type >= APR_MSG_TYPE_MAX && msg_type != APR_BASIC_RSP_RESULT) { |