Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59e1ece3 authored by Karthik Reddy Katta's avatar Karthik Reddy Katta Committed by Gerrit - the friendly Code Review server
Browse files

drivers: soc: qcom: Add overflow check for sound model size 



Overflow check is added for sound model size to prevent
heap overflow while allocating memory for sound model data.

CRs-Fixed: 1100682
Change-Id: Id38523a5e79028c692670e84d5fe924a855a5a10
Signed-off-by: default avatarKarthik Reddy Katta <a_katta@codeaurora.org>
parent 8edabdf5

sound/soc/msm/msm-cpe-lsm.c

+7 −0
Original line number Diff line number Diff line
@@ -1941,6 +1941,13 @@ static int msm_cpe_lsm_reg_model(struct snd_pcm_substream *substream, 


	lsm_ops->lsm_get_snd_model_offset(cpe->core_handle,

			session, &offset);

	/* Check if 'p_info->param_size + offset' crosses U32_MAX. */

	if (p_info->param_size > U32_MAX - offset) {

		dev_err(rtd->dev,

			"%s: Invalid param_size %d\n",

			__func__, p_info->param_size);

		return -EINVAL;

	}

	session->snd_model_size = p_info->param_size + offset;



	session->snd_model_data = vzalloc(session->snd_model_size);