Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a27ad2f1 authored by Karthikeyan Mani's avatar Karthikeyan Mani Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: check for buffer size before read 



Check for debugfs ops buf size passed before reading
to eliminate the possibility of reading out of bounds.

Change-Id: I28fd60ce93256b6b0bad62b449092a891cc15463
Signed-off-by: default avatarKarthikeyan Mani <kmani@codeaurora.org>
parent 102ccfb3

sound/soc/msm/qdsp6v2/q6asm.c

+10 −0
Original line number Original line Diff line number Diff line
@@ -148,6 +148,11 @@ static ssize_t audio_output_latency_dbgfs_read(struct file *file, 
		pr_err("%s: out_buffer is null\n", __func__);

		pr_err("%s: out_buffer is null\n", __func__);

		return 0;

		return 0;

	}

	}

	if (count < OUT_BUFFER_SIZE) {

		pr_err("%s: read size %d exceeds buf size %zd\n", __func__,

						OUT_BUFFER_SIZE, count);

		return 0;

	}

	snprintf(out_buffer, OUT_BUFFER_SIZE, "%ld,%ld,%ld,%ld,%ld,%ld,",\

	snprintf(out_buffer, OUT_BUFFER_SIZE, "%ld,%ld,%ld,%ld,%ld,%ld,",\

		out_cold_tv.tv_sec, out_cold_tv.tv_usec, out_warm_tv.tv_sec,\

		out_cold_tv.tv_sec, out_cold_tv.tv_usec, out_warm_tv.tv_sec,\

		out_warm_tv.tv_usec, out_cont_tv.tv_sec, out_cont_tv.tv_usec);

		out_warm_tv.tv_usec, out_cont_tv.tv_sec, out_cont_tv.tv_usec);
@@ -201,6 +206,11 @@ static ssize_t audio_input_latency_dbgfs_read(struct file *file, 
		pr_err("%s: in_buffer is null\n", __func__);

		pr_err("%s: in_buffer is null\n", __func__);

		return 0;

		return 0;

	}

	}

	if (count < IN_BUFFER_SIZE) {

		pr_err("%s: read size %d exceeds buf size %zd\n", __func__,

						IN_BUFFER_SIZE, count);

		return 0;

	}

	snprintf(in_buffer, IN_BUFFER_SIZE, "%ld,%ld,",\

	snprintf(in_buffer, IN_BUFFER_SIZE, "%ld,%ld,",\

				in_cont_tv.tv_sec, in_cont_tv.tv_usec);

				in_cont_tv.tv_sec, in_cont_tv.tv_usec);

	return  simple_read_from_buffer(buf, IN_BUFFER_SIZE, ppos,

	return  simple_read_from_buffer(buf, IN_BUFFER_SIZE, ppos,