Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ae8e56c authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "ASoC: msm-compr: Fix possible array out of bounds"

parents d707e346 61c2f071

include/uapi/sound/compress_params.h

+4 −2
Original line number Diff line number Diff line
@@ -53,6 +53,8 @@ 


#include <linux/types.h>



#define SND_DEC_DDP_MAX_PARAMS 18



/* AUDIO CODECS SUPPORTED */

#define MAX_NUM_CODECS 32

#define MAX_NUM_CODEC_DESCRIPTORS 32
@@ -344,8 +346,8 @@ struct snd_enc_generic { 


struct snd_dec_ddp {

	__u32 params_length;

	__u32 params_id[18];

	__u32 params_value[18];

	__u32 params_id[SND_DEC_DDP_MAX_PARAMS];

	__u32 params_value[SND_DEC_DDP_MAX_PARAMS];

} __attribute__((packed, aligned(4)));



struct snd_dec_flac {

sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c

+8 −0
Original line number Diff line number Diff line
@@ -347,6 +347,14 @@ static int msm_compr_send_ddp_cfg(struct audio_client *ac, 
{

	int i, rc;

	pr_debug("%s\n", __func__);



	if (ddp->params_length / 2 > SND_DEC_DDP_MAX_PARAMS) {

		pr_err("%s: Invalid number of params %u, max allowed %u\n",

			__func__, ddp->params_length / 2,

			SND_DEC_DDP_MAX_PARAMS);

		return -EINVAL;

	}



	for (i = 0; i < ddp->params_length/2; i++) {

		rc = q6asm_ds1_set_endp_params(ac, ddp->params_id[i],

						ddp->params_value[i]);