Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0ef7330f authored by Sharad Sangle's avatar Sharad Sangle Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: DAP: Add check to validate param length 



To avoid buffer overflow, validate input length used to
fetch visualizer data.

CRs-fixed: 1096672
Change-Id: I224bc2f20d94182713c565972fb0bd52cad6f3fd
Signed-off-by: default avatarSharad Sangle <assangle@codeaurora.org>
parent 2db9737c

sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c

+10 −1
Original line number Original line Diff line number Diff line 
/* Copyright (c) 2013-2014, 2017 The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and

 * only version 2 as published by the Free Software Foundation.

 * only version 2 as published by the Free Software Foundation.
@@ -18,6 +18,10 @@ 




#include "msm-dolby-dap-config.h"

#include "msm-dolby-dap-config.h"





#ifndef DOLBY_PARAM_VCNB_MAX_LENGTH

#define DOLBY_PARAM_VCNB_MAX_LENGTH 40

#endif



/* dolby endp based parameters */

/* dolby endp based parameters */

struct dolby_dap_endp_params_s {

struct dolby_dap_endp_params_s {

	int device;

	int device;
@@ -899,6 +903,11 @@ int msm_dolby_dap_param_visualizer_control_get(struct snd_kcontrol *kcontrol, 
		DOLBY_PARAM_PAYLOAD_SIZE * sizeof(uint32_t);

		DOLBY_PARAM_PAYLOAD_SIZE * sizeof(uint32_t);

	int port_id, copp_idx, idx;

	int port_id, copp_idx, idx;





	if (length > DOLBY_PARAM_VCNB_MAX_LENGTH || length <= 0) {

		pr_err("%s Incorrect VCNB length", __func__);

		ucontrol->value.integer.value[0] = 0;

		return -EINVAL;

	}

	for (idx = 0; idx < AFE_MAX_PORTS; idx++) {

	for (idx = 0; idx < AFE_MAX_PORTS; idx++) {

		port_id = dolby_dap_params_states.port_id[idx];

		port_id = dolby_dap_params_states.port_id[idx];

		copp_idx = dolby_dap_params_states.copp_idx[idx];

		copp_idx = dolby_dap_params_states.copp_idx[idx];