Merge "ASoC: msm: Add check for NULL pointer and buffer overflow" (8f7d9a8e) · Commits · e / devices / android_kernel_sony_msm8994

sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1043,7 +1043,7 @@ static int msm_compr_ioctl_shared(struct snd_pcm_substream *substream,
		pr_err("%s: copy ddp params value, size=%d\n",
		__func__, params_length);
		pr_debug("params_length: %d\n", ddp->params_length);
		for (i = 0; i < params_length; i++)
		for (i = 0; i < params_length/sizeof(int); i++)
		pr_debug("params_value[%d]: %x\n", i,
		params_value_data[i]);
		for (i = 0; i < ddp->params_length/2; i++) {

+12 −3

Original line number	Diff line number	Diff line
		@@ -271,14 +271,21 @@ static void compr_event_handler(uint32_t opcode,
		uint32_t token, uint32_t payload, void priv)
		{
		struct msm_compr_audio *prtd = priv;
		struct snd_compr_stream *cstream = prtd->cstream;
		struct audio_client *ac = prtd->audio_client;
		struct snd_compr_stream *cstream;
		struct audio_client *ac;
		uint32_t chan_mode = 0;
		uint32_t sample_rate = 0;
		int bytes_available, stream_id;
		uint32_t stream_index;
		unsigned long flags;

		if (!prtd) {
		pr_err("%s: prtd is NULL\n", __func__);
		return;
		}
		cstream = prtd->cstream;
		ac = prtd->audio_client;

		pr_debug("%s opcode =%08x\n", __func__, opcode);
		switch (opcode) {
		case ASM_DATA_EVENT_WRITE_DONE_V2:
		@@ -1667,8 +1674,10 @@ static int msm_compr_set_metadata(struct snd_compr_stream *cstream,
		return -EINVAL;

		prtd = cstream->runtime->private_data;
		if (!prtd && !prtd->audio_client)
		if (!prtd \|\| !prtd->audio_client) {
		pr_err("%s: prtd or audio client is NULL\n", __func__);
		return -EINVAL;
		}
		ac = prtd->audio_client;
		if (metadata->key == SNDRV_COMPRESS_ENCODER_PADDING) {
		pr_debug("%s, got encoder padding %u", __func__, metadata->value[0]);