Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7bf20eaa authored by Aravind Kumar's avatar Aravind Kumar
Browse files

ASoC: msm: Add check for NULL pointer and buffer overflow 



Changes to add check for NULL pointer before they
get dereferenced and check for buffer overflows
to ensure out of bound indexes of arrays are not
accessed.

CRs-fixed: 628847 628850
Change-Id: I3fcebe07a7f9e7ff480857480fa0df2ada017c69
Signed-off-by: default avatarAravind Kumar <akumark@codeaurora.org>
parent b5c75c4d

sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c

+1 −1
Original line number Diff line number Diff line
@@ -1043,7 +1043,7 @@ static int msm_compr_ioctl_shared(struct snd_pcm_substream *substream, 
				pr_err("%s: copy ddp params value, size=%d\n",

					__func__, params_length);

			pr_debug("params_length: %d\n", ddp->params_length);

			for (i = 0; i < params_length; i++)

			for (i = 0; i < params_length/sizeof(int); i++)

				pr_debug("params_value[%d]: %x\n", i,

					params_value_data[i]);

			for (i = 0; i < ddp->params_length/2; i++) {

sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c

+12 −3
Original line number Diff line number Diff line
@@ -271,14 +271,21 @@ static void compr_event_handler(uint32_t opcode, 
		uint32_t token, uint32_t *payload, void *priv)

{

	struct msm_compr_audio *prtd = priv;

	struct snd_compr_stream *cstream = prtd->cstream;

	struct audio_client *ac = prtd->audio_client;

	struct snd_compr_stream *cstream;

	struct audio_client *ac;

	uint32_t chan_mode = 0;

	uint32_t sample_rate = 0;

	int bytes_available, stream_id;

	uint32_t stream_index;

	unsigned long flags;



	if (!prtd) {

		pr_err("%s: prtd is NULL\n", __func__);

		return;

	}

	cstream = prtd->cstream;

	ac = prtd->audio_client;



	pr_debug("%s opcode =%08x\n", __func__, opcode);

	switch (opcode) {

	case ASM_DATA_EVENT_WRITE_DONE_V2:
@@ -1663,8 +1670,10 @@ static int msm_compr_set_metadata(struct snd_compr_stream *cstream, 
		return -EINVAL;



	prtd = cstream->runtime->private_data;

	if (!prtd && !prtd->audio_client)

	if (!prtd || !prtd->audio_client) {

		pr_err("%s: prtd or audio client is NULL\n", __func__);

		return -EINVAL;

	}

	ac = prtd->audio_client;

	if (metadata->key == SNDRV_COMPRESS_ENCODER_PADDING) {

		pr_debug("%s, got encoder padding %u", __func__, metadata->value[0]);