Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 748165aa authored by Meng Wang's avatar Meng Wang
Browse files

asoc: codec: add range check to avoid overflow 



Add range check for ucontrol value to avoid array
overflow.

Change-Id: I7b699519bec6f605e5ca5ece8f67badbefc7a094
Signed-off-by: default avatarMeng Wang <mengw@codeaurora.org>
parent 78fff069

asoc/codecs/swr-dmic.c

+6 −2
Original line number Diff line number Diff line
@@ -174,7 +174,7 @@ static int swr_dmic_tx_master_port_put(struct snd_kcontrol *kcontrol, 
				snd_soc_kcontrol_component(kcontrol);

	struct swr_dmic_priv *swr_dmic = NULL;

	int ret = 0;

	unsigned int slave_port_idx = SWR_DMIC_MAX_PORTS;

	unsigned int slave_port_idx = SWR_DMIC_MAX_PORTS, idx = 0;



	if (NULL == component) {

		pr_err("%s: swr dmic component is NULL\n", __func__);
@@ -199,8 +199,12 @@ static int swr_dmic_tx_master_port_put(struct snd_kcontrol *kcontrol, 
		return -EINVAL;

	}



	idx = ucontrol->value.enumerated.item[0];

	if (idx < 0 || idx >= ARRAY_SIZE(swr_master_channel_map))

		return -EINVAL;



	swr_dmic->tx_master_port_map[slave_port_idx] =

		swr_master_channel_map[ucontrol->value.enumerated.item[0]];

			swr_master_channel_map[idx];

	dev_dbg(component->dev, "%s: slv port id: %d, master_port_type: %d\n",

		__func__, slave_port_idx,

		swr_dmic->tx_master_port_map[slave_port_idx]);

asoc/codecs/wcd937x/wcd937x.c

+33 −12
Original line number Diff line number Diff line
@@ -2048,12 +2048,21 @@ static int wcd937x_tx_master_ch_get(struct snd_kcontrol *kcontrol, 
{

	struct snd_soc_component *component =

				snd_soc_kcontrol_component(kcontrol);

	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);

	int slave_ch_idx;

	struct wcd937x_priv *wcd937x = NULL;

	int slave_ch_idx = -EINVAL;



	if (component == NULL)

		return -EINVAL;



	wcd937x = snd_soc_component_get_drvdata(component);

	if (wcd937x == NULL)

		return -EINVAL;



	wcd937x_tx_get_slave_ch_type_idx(kcontrol->id.name, &slave_ch_idx);



	if (slave_ch_idx != -EINVAL)

	if (slave_ch_idx < 0 || slave_ch_idx >= WCD937X_MAX_SLAVE_CH_TYPES)

		return -EINVAL;



	ucontrol->value.integer.value[0] =

			wcd937x_slave_get_master_ch_val(

			wcd937x->tx_master_ch_map[slave_ch_idx]);
@@ -2068,19 +2077,31 @@ static int wcd937x_tx_master_ch_put(struct snd_kcontrol *kcontrol, 
{

	struct snd_soc_component *component =

				snd_soc_kcontrol_component(kcontrol);

	struct wcd937x_priv *wcd937x = snd_soc_component_get_drvdata(component);

	int slave_ch_idx;

	struct wcd937x_priv *wcd937x;

	int slave_ch_idx = -EINVAL, idx = 0;



	if (component == NULL)

		return -EINVAL;



	wcd937x = snd_soc_component_get_drvdata(component);

	if (wcd937x == NULL)

		return -EINVAL;



	wcd937x_tx_get_slave_ch_type_idx(kcontrol->id.name, &slave_ch_idx);



	if (slave_ch_idx < 0 || slave_ch_idx >= WCD937X_MAX_SLAVE_CH_TYPES)

		return -EINVAL;



	dev_dbg(component->dev, "%s: slave_ch_idx: %d", __func__, slave_ch_idx);

	dev_dbg(component->dev, "%s: ucontrol->value.enumerated.item[0] = %ld\n",

			__func__, ucontrol->value.enumerated.item[0]);



	if (slave_ch_idx != -EINVAL)

	idx = ucontrol->value.enumerated.item[0];

	if (idx < 0 || idx >= ARRAY_SIZE(wcd937x_swr_master_ch_map))

		return -EINVAL;



	wcd937x->tx_master_ch_map[slave_ch_idx] =

				wcd937x_slave_get_master_ch(

					ucontrol->value.enumerated.item[0]);

			wcd937x_slave_get_master_ch(idx);



	return 0;

}

asoc/codecs/wcd938x/wcd938x.c

+6 −3
Original line number Diff line number Diff line
@@ -2869,7 +2869,7 @@ static int wcd938x_tx_master_ch_put(struct snd_kcontrol *kcontrol, 
	struct snd_soc_component *component =

				snd_soc_kcontrol_component(kcontrol);

	struct wcd938x_priv *wcd938x = NULL;

	int slave_ch_idx = -EINVAL;

	int slave_ch_idx = -EINVAL, idx = 0;



	if (component == NULL)

		return -EINVAL;
@@ -2887,8 +2887,11 @@ static int wcd938x_tx_master_ch_put(struct snd_kcontrol *kcontrol, 
	dev_dbg(component->dev, "%s: ucontrol->value.enumerated.item[0] = %ld\n",

			__func__, ucontrol->value.enumerated.item[0]);



	wcd938x->tx_master_ch_map[slave_ch_idx] = wcd938x_slave_get_master_ch(

				ucontrol->value.enumerated.item[0]);

	idx = ucontrol->value.enumerated.item[0];

	if (idx < 0 || idx >= ARRAY_SIZE(swr_master_ch_map))

		return -EINVAL;



	wcd938x->tx_master_ch_map[slave_ch_idx] = wcd938x_slave_get_master_ch(idx);

	return 0;

}