Merge "ASoC: msm-pcm-host-voice: Address buffer overflow in hpcm playback copy" (e9cdb60d) · Commits · e / devices / android_kernel_fairphone_FP5

asoc/msm-pcm-host-voice-v2.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -663,6 +663,13 @@ static void hpcm_copy_playback_data_from_queue(struct dai_data *dai_data,
		struct hpcm_buf_node, list);
		list_del(&buf_node->list);
		*len = buf_node->frame.len;

		if (*len > HPCM_MAX_VOC_PKT_SIZE) {
		pr_err("%s: Playback data len %d overflow\n",
		__func__, *len);
		return;
		}

		memcpy((u8 *)dai_data->vocpcm_ion_buffer.kvaddr,
		&buf_node->frame.voc_pkt[0],
		buf_node->frame.len);
		@@ -690,8 +697,8 @@ static void hpcm_copy_capture_data_to_queue(struct dai_data *dai_data,
		if (dai_data->substream == NULL)
		return;

		if (len >= HPCM_MAX_VOC_PKT_SIZE) {
		pr_err("%s: Copy capture data len %d is > HPCM_MAX_VOC_PKT_SIZE\n",
		if (len > HPCM_MAX_VOC_PKT_SIZE) {
		pr_err("%s: Copy capture data len %d overflow\n",
		__func__, len);
		return;
		}