Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2a297d8 authored by Weiyin Jiang's avatar Weiyin Jiang Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: audio-effects: Check for array index 



EQ index is copied over from userspace. There's potential risk that
this value can exceed the array boundary. A sanity check for the index
is required.

Change-Id: Ic57a00521119c9fa77dfe0971d58da701092f850
CRs-Fixed: 791363
Signed-off-by: default avatarWeiyin Jiang <wjiang@codeaurora.org>
parent 7ec67867

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c

+6 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -739,6 +739,11 @@ int msm_audio_effects_popless_eq_handler(struct audio_client *ac, 
			}

			for (j = 0; j < eq->config.num_bands; j++) {

				idx = *values++;

				if (idx >= MAX_EQ_BANDS) {

					pr_err("EQ_CONFIG:invalid band index\n");

					rc = -EINVAL;

					goto invalid_config;

				}

				eq->per_band_cfg[idx].band_idx = idx;

				eq->per_band_cfg[idx].filter_type = *values++;

				eq->per_band_cfg[idx].freq_millihertz =