Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0714ffdf authored by Vatsal Bucha's avatar Vatsal Bucha Committed by Gerrit - the friendly Code Review server
Browse files

dsp: q6voice: Check size of shared memory buffer before access 



Check buffer size in qdsp_cvs_callback before access in
ul_pkt.

Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: default avatarVatsal Bucha <vbucha@codeaurora.org>
parent 8766446f

dsp/q6voice.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -7740,6 +7740,11 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) 




		cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;

		cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;

		if (cvs_voc_pkt != NULL &&  common.mvs_info.ul_cb != NULL) {

		if (cvs_voc_pkt != NULL &&  common.mvs_info.ul_cb != NULL) {

			if (v->shmem_info.sh_buf.buf[1].size <

			    ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {

				pr_err("%s: invalid voc pkt size\n", __func__);

				return -EINVAL;

			}

			/* cvs_voc_pkt[0] contains tx timestamp */

			/* cvs_voc_pkt[0] contains tx timestamp */

			common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],

			common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],

					      cvs_voc_pkt[2],

					      cvs_voc_pkt[2],