Commit c334cc82 authored Apr 12, 2023 by Sandhya Mutha Naga Venkata

dsp: q6core: Avoid OOB access in q6core



"num_services", a signed integer when compared
with constant results in conversion of signed integer
to max possible unsigned int value when "num_services"
is a negative value. This can lead to OOB read.
Fix is to handle this case.

Change-Id: Id6a8f150d9019c972a87f789e4c626337a97bfff
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>

parent f134827a

dsp/q6core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -205,7 +205,7 @@ EXPORT_SYMBOL(q6core_send_uevent);
		static int parse_fwk_version_info(uint32_t *payload, uint16_t payload_size)
		{
		size_t ver_size;
		int num_services;
		uint16_t num_services;

		pr_debug("%s: Payload info num services %d\n",
		__func__, payload[4]);