Unverified Commit 7883946a authored Feb 10, 2024 by Michael Bestas

Merge tag 'LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0' of...

Merge tag 'LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel into android13-4.19-kona

"LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0"

* tag 'LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
  Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));

Change-Id: I8869b37a4cc5223d37ec0169efb6eb2965916dd6

parents cc009419 724bbe81

techpack/audio/asoc/msm-lsm-client.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -2167,8 +2167,13 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
		prtd->lsm_client->get_param_payload = NULL;
		goto done;
		}
		if (__builtin_uadd_overflow(sizeof(p_info_32), p_info_32.param_size, &size)) {
		pr_err("%s: param size exceeds limit of %u bytes.\n",
		__func__, UINT_MAX);
		err = -EINVAL;
		goto done;
		}

		size = sizeof(p_info_32) + p_info_32.param_size;
		param_info_rsp = kzalloc(size, GFP_KERNEL);

		if (!param_info_rsp) {