Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f73583a authored by Kunlei Zhang's avatar Kunlei Zhang
Browse files

dsp: update size check for set/get VI param function 



In afe_set_cal_sp_th_vi_cfg and afe_get_cal_sp_th_vi_param
functions, data size is not checked properly which might
lead to out of bounds access.

Add data_size check to avoid out of bounds access.

Change-Id: Ibe049300c609d0d717309bccc65cac876ac075f7
Signed-off-by: default avatarKunlei Zhang <kunleiz@codeaurora.org>
parent 2b79066d

dsp/q6afe.c

+6 −1
Original line number Diff line number Diff line
@@ -11013,6 +11013,9 @@ static int afe_set_cal_sp_th_vi_cfg(int32_t cal_type, size_t data_size, 


	if (cal_data == NULL ||

	    data_size > sizeof(*cal_data) ||

	    (data_size < sizeof(cal_data->cal_hdr) +

		sizeof(cal_data->cal_data) +

		sizeof(cal_data->cal_info.mode)) ||

	    this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)

		goto done;
@@ -11230,7 +11233,9 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size, 


	if (cal_data == NULL ||

	    data_size > sizeof(*cal_data) ||

	    data_size < sizeof(cal_data->cal_hdr) ||

	    (data_size < sizeof(cal_data->cal_hdr) +

		sizeof(cal_data->cal_data) +

		sizeof(cal_data->cal_info.mode)) ||

	    this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)

		return 0;