Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d9d0cc00 authored by Xiaoyu Ye's avatar Xiaoyu Ye Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: Add range checking in msm_dai_q6_set_channel_map 



Range checking is added to prevent buffer overflow that due to inputs
can be set by user space.

CRs-Fixed: 1098363
Change-Id: I057261291806240ee6d7b8106a5e83a7665e013d
Signed-off-by: default avatarXiaoyu Ye <benyxy@codeaurora.org>
parent 5712040c

sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c

+10 −0
Original line number Diff line number Diff line
@@ -1894,6 +1894,11 @@ static int msm_dai_q6_set_channel_map(struct snd_soc_dai *dai, 
			pr_err("%s: rx slot not found\n", __func__);

			return -EINVAL;

		}

		if (rx_num > AFE_PORT_MAX_AUDIO_CHAN_CNT) {

			pr_err("%s: invalid rx num %d\n", __func__, rx_num);

			return -EINVAL;

		}



		for (i = 0; i < rx_num; i++) {

			dai_data->port_config.slim_sch.shared_ch_mapping[i] =

			    rx_slot[i];
@@ -1926,6 +1931,11 @@ static int msm_dai_q6_set_channel_map(struct snd_soc_dai *dai, 
			pr_err("%s: tx slot not found\n", __func__);

			return -EINVAL;

		}

		if (tx_num > AFE_PORT_MAX_AUDIO_CHAN_CNT) {

			pr_err("%s: invalid tx num %d\n", __func__, tx_num);

			return -EINVAL;

		}



		for (i = 0; i < tx_num; i++) {

			dai_data->port_config.slim_sch.shared_ch_mapping[i] =

			    tx_slot[i];