Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca24a9fa authored by Shimana P's avatar Shimana P Committed by Shaik Jabida
Browse files

dsp: q6voice: Add buf size check for cvp cal data 



Check for the max size of cvp command register
calibration data that can be copied to avoid
buffer overflow.

Change-Id: I41793bef75095ef06d7dda171bd2eba158422cc9
Signed-off-by: default avatarShimana P <quic_shimp@quicinc.com>
parent 8fd74548

dsp/q6voice.c

+14 −0
Original line number Diff line number Diff line
@@ -3221,6 +3221,13 @@ static int voice_send_cvp_register_cal_cmd(struct voice_data *v) 
		 voc_get_session_name(v->session_id), v->dev_tx.dev_id,

		 v->dev_rx.dev_id);



	if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {

		pr_err("%s: Invalid cal data size %d!\n",

			__func__, col_data->cal_data.size);

		ret = -EINVAL;

		goto unlock;

	}



	memcpy(&cvp_reg_cal_cmd.cvp_cal_data.column_info[0],

	       (void *) &((struct audio_cal_info_voc_col *)

	       col_data->cal_info)->data,
@@ -3381,6 +3388,13 @@ static int voice_send_cvp_register_vol_cal_cmd(struct voice_data *v) 
		goto unlock;

	}



	if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {

		pr_err("%s: Invalid cal data size %d!\n",

			__func__, col_data->cal_data.size);

		ret = -EINVAL;

		goto unlock;

	}



	memcpy(&cvp_reg_vol_cal_cmd.cvp_vol_cal_data.column_info[0],

	       (void *) &((struct audio_cal_info_voc_col *)

	       col_data->cal_info)->data,