Merge "dsp: q6voice: Check size of shared memory buffer before access" (ae8bc1e1) · Commits · e / devices / android_kernel_oneplus_sm7250

dsp/q6voice.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -7740,6 +7740,11 @@ static int32_t qdsp_cvs_callback(struct apr_client_data data, void priv)

		cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
		if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) {
		if (v->shmem_info.sh_buf.buf[1].size <
		((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
		pr_err("%s: invalid voc pkt size\n", __func__);
		return -EINVAL;
		}
		/* cvs_voc_pkt[0] contains tx timestamp */
		common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],
		cvs_voc_pkt[2],