Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c319c2b0 authored by Ashish Jain's avatar Ashish Jain Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: DAP: Add check to validate param length 



To avoid buffer overflow, validate input length used to
fetch visualizer data.

CRs-Fixed: 1033540
Change-Id: I445d1ba3bce47308bc31ae24a70d5ee358f22a2d
Signed-off-by: default avatarAshish Jain <ashishj@codeaurora.org>
parent 3f2ae090

sound/soc/msm/qdsp6v2/msm-dolby-common.h

+2 −1
Original line number Diff line number Diff line 


/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * only version 2 as published by the Free Software Foundation.
@@ -232,6 +232,7 @@ 


#define TOTAL_LENGTH_DOLBY_PARAM		745

#define DOLBY_VIS_PARAM_HEADER_SIZE		25

#define DOLBY_PARAM_VCNB_MAX_LENGTH		40



#define DOLBY_INVALID_PORT_ID			-1

sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c

+7 −0
Original line number Diff line number Diff line
@@ -1635,6 +1635,13 @@ static int msm_ds2_dap_param_visualizer_control_get(u32 cmd, void *arg) 
	}



	length = ds2_dap_params[cache_dev].params_val[DOLBY_PARAM_VCNB_OFFSET];



	if (length > DOLBY_PARAM_VCNB_MAX_LENGTH || length <= 0) {

		ret = 0;

		dolby_data->length = 0;

		pr_err("%s Incorrect VCNB length", __func__);

	}



	params_length = (2*length + DOLBY_VIS_PARAM_HEADER_SIZE) *

							 sizeof(uint32_t);