Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 750920e0 authored by Weiyin Jiang's avatar Weiyin Jiang Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: audio-effects: fix stack overread and heap overwrite 



Fix overwrite of updt_params allocated in heap, and stack overread
where param pointer is passed from user space.

CRs-Fixed: 989628
Change-Id: Ida8bdb7da2fcb97023dce3b6eafe4b899a51cb66
Signed-off-by: default avatarWeiyin Jiang <wjiang@codeaurora.org>
parent 359d85b4

drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c

+1 −2
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

 * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

 *

 * This software is licensed under the terms of the GNU General Public

 * License version 2, as published by the Free Software Foundation, and
@@ -20,7 +20,6 @@ 
#include <sound/msm-dts-eagle.h>



#define MAX_CHANNELS_SUPPORTED		8

#define MAX_PP_PARAMS_SZ		128

#define WAIT_TIMEDOUT_DURATION_SECS	1



struct q6audio_effects {

include/sound/msm-audio-effects-q6-v2.h

+3 −1
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.

 * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -16,6 +16,8 @@ 


#include <sound/audio_effects.h>



#define MAX_PP_PARAMS_SZ   128



bool msm_audio_effects_is_effmodule_supp_in_top(int effect_module,

						int topology);

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c

+583 −252

File changed.

Preview size limit exceeded, changes collapsed.

sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c

+1 −1
Original line number Diff line number Diff line
@@ -2839,7 +2839,7 @@ static int msm_compr_audio_effects_config_info(struct snd_kcontrol *kcontrol, 
					       struct snd_ctl_elem_info *uinfo)

{

	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;

	uinfo->count = 128;

	uinfo->count = MAX_PP_PARAMS_SZ;

	uinfo->value.integer.min = 0;

	uinfo->value.integer.max = 0xFFFFFFFF;

	return 0;