asoc:msm-lsm-client: check for param size before copying



check for the proper param size before copying,
to avoid OOB memory access of buffer.

Change-Id: I8e9bd3b4be9a2797e76dce403578c038fc07dd58
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>

parent f47869b5

asoc/msm-lsm-client.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -782,6 +782,13 @@ static int msm_lsm_reg_model(struct snd_pcm_substream *substream,

		q6lsm_sm_set_param_data(client, p_info, &offset, sm);

		if ((sm->size - offset) < p_info->param_size) {
		dev_err(rtd->dev, "%s: user buff size is greater than expected\n",
		__func__);
		rc = -EINVAL;
		goto err_copy;
		}

		/*
		* For set_param, advance the sound model data with the
		* number of bytes required by param_data.