Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfc27c61 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "ASoC: msm: fix bounds checking for ADM get params"

parents 809160a9 9c847cc6

sound/soc/msm/qdsp6v2/q6adm.c

+10 −4
Original line number Diff line number Diff line
@@ -832,7 +832,7 @@ int adm_get_params(int port_id, int copp_idx, uint32_t module_id, 
		idx) &&

		(ARRAY_SIZE(adm_get_parameters) >=

		1+adm_get_parameters[idx]+idx) &&

		(params_length/sizeof(int) >=

		(params_length/sizeof(uint32_t) >=

		adm_get_parameters[idx])) {

		for (i = 0; i < adm_get_parameters[idx]; i++)

			params_data[i] = adm_get_parameters[1+i+idx];
@@ -1166,17 +1166,23 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) 
			idx = ADM_GET_PARAMETER_LENGTH * copp_idx;

			if ((payload[0] == 0) && (data->payload_size >

				(4 * sizeof(*payload))) &&

				(data->payload_size/sizeof(*payload)-4 >=

				(data->payload_size - 4 >=

				payload[3]) &&

				(ARRAY_SIZE(adm_get_parameters) >

				idx) &&

				(ARRAY_SIZE(adm_get_parameters)-idx-1 >=

				payload[3])) {

				adm_get_parameters[idx] = payload[3];

				adm_get_parameters[idx] = payload[3] /

							sizeof(uint32_t);

				/*

				 * payload[3] is param_size which is

				 * expressed in number of bytes

				 */

				pr_debug("%s: GET_PP PARAM:received parameter length: 0x%x\n",

					__func__, adm_get_parameters[idx]);

				/* storing param size then params */

				for (i = 0; i < payload[3]; i++)

				for (i = 0; i < payload[3] /

						sizeof(uint32_t); i++)

					adm_get_parameters[idx+1+i] =

							payload[4+i];

			} else {