Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 13cc6ff4 authored by Kumar Anurag Singh's avatar Kumar Anurag Singh Committed by Abinath S
Browse files

Fix for OOB access issue 



Added payload size check to avoid OOB read issues.

Change-Id: I4f15bdfdcf15e388ebc49dd0e8cf7a99ed03d0d5
Signed-off-by: default avatarKumar Anurag Singh <quic_kumaranu@quicinc.com>
(cherry picked from commit fb09ec8587ea689fc274c0e1b9d096b55cea36c8)
parent 00f847b2

dsp/q6adm.c

+5 −10
Original line number Diff line number Diff line
@@ -1592,17 +1592,12 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) 
		if (data->opcode == APR_BASIC_RSP_RESULT) {

			pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n",

				__func__, payload[0]);



			if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) &&

			     ((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) ||

			      (payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) {

			if (data->payload_size <

					(2 * sizeof(uint32_t))) {

				pr_err("%s: Invalid payload size %d\n",

					__func__, data->payload_size);

				return 0;

			}

			}



			if (payload[1] != 0) {

				pr_err("%s: cmd = 0x%x returned error = 0x%x\n",