Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14986209 authored by yidongh's avatar yidongh Committed by Banajit Goswami
Browse files

ASOC: msm: Restrict loop index to avoid buffer overread 



Add restriction in msm_dolby_dap_param_to_get_control_get
function to avoid reading buffer data with index over
buffer size.

Change-Id: I2bd443d4db1a272d20341fbb5b15891a8acf0bc8
CRs-Fixed: 1096076
Signed-off-by: default avatarYidong Huang <yidongh@codeaurora.org>
parent 9f05dfa8

sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c

+4 −0
Original line number Diff line number Diff line
@@ -818,6 +818,10 @@ int msm_dolby_dap_param_to_get_control_get(struct snd_kcontrol *kcontrol, 
			 __func__, copp_idx);

		return -EINVAL;

	}

	if (dolby_dap_params_get.length > 128 - DOLBY_PARAM_PAYLOAD_SIZE) {

		pr_err("%s: Incorrect parameter length", __func__);

		return -EINVAL;

	}

	params_value = kzalloc(params_length + param_payload_len, GFP_KERNEL);

	if (!params_value)

		return -ENOMEM;