Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c004dec authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "dsp: afe: check for minimum size before payload access"

parents f7f2404c 0ee70410

sound/soc/msm/qdsp6v2/q6afe.c

+15 −0
Original line number Diff line number Diff line
@@ -332,6 +332,11 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload, 
	/* Set command specific details */

	switch (opcode) {

	case AFE_PORT_CMDRSP_GET_PARAM_V2:

		if (payload_size < (5 * sizeof(uint32_t))) {

			pr_err("%s: Error: size %d is less than expected\n",

				__func__, payload_size);

			return -EINVAL;

		}

		expected_size += sizeof(struct param_hdr_v1);

		param_hdr.module_id = payload[1];

		param_hdr.instance_id = INSTANCE_ID_0;
@@ -340,7 +345,17 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload, 
		data_start = &payload[4];

		break;

	case AFE_PORT_CMDRSP_GET_PARAM_V3:

		if (payload_size < (6 * sizeof(uint32_t))) {

			pr_err("%s: Error: size %d is less than expected\n",

				__func__, payload_size);

			return -EINVAL;

		}

		expected_size += sizeof(struct param_hdr_v3);

		if (payload_size < expected_size) {

			pr_err("%s: Error: size %d is less than expected\n",

				__func__, payload_size);

			return -EINVAL;

		}

		memcpy(&param_hdr, &payload[1], sizeof(struct param_hdr_v3));

		data_start = &payload[5];

		break;