Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4c1f3568 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "dsp: fix out of bound access for cal_data size"

parents e6e670fd 2e32fdc9

dsp/q6afe.c

+2 −4
Original line number Diff line number Diff line
@@ -11280,8 +11280,7 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size, 
	pr_debug("%s: cal_type = %d\n", __func__, cal_type);

	if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL ||

	    cal_data == NULL ||

	    data_size > sizeof(*cal_data) ||

	    data_size < sizeof(cal_data->cal_hdr))

	    data_size != sizeof(*cal_data))

		goto done;



	mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock);
@@ -11348,8 +11347,7 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, 
	pr_debug("%s: cal_type = %d\n", __func__, cal_type);

	if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL ||

	    cal_data == NULL ||

	    data_size > sizeof(*cal_data) ||

	    data_size < sizeof(cal_data->cal_hdr))

	    data_size != sizeof(*cal_data))

		goto done;



	mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock);