Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e668fa27 authored by Soumya Managoli's avatar Soumya Managoli Committed by Gerrit - the friendly Code Review server
Browse files

dsp: adm: Add error check to avoid memory overread 



For ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST adsp response,
add additional check to make sure there is enough
data for copy from adsp payload.

Change-Id: Ib8fef116ca73ce68e872616db969f7112f289b69
Signed-off-by: default avatarSoumya Managoli <smanag@codeaurora.org>
parent ff4075e5

dsp/q6adm.c

+7 −4
Original line number Diff line number Diff line
@@ -1803,9 +1803,12 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) 
				pr_err(":err = 0x%x\n", payload[0]);

			} else if (data->payload_size >=

				   (2 * sizeof(uint32_t))) {

				if (payload[1] >

				if ((payload[1] >

				    ((ADM_GET_TOPO_MODULE_LIST_LENGTH /

				    sizeof(uint32_t)) - 1)) {

				    sizeof(uint32_t)) - 1)) ||

				((data->payload_size -

					(2 *  sizeof(uint32_t))) <

					(payload[1] * sizeof(uint32_t)))) {

					pr_err("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST",

						 __func__);

					pr_err(":size = %d\n", payload[1]);