Commit c3c9341b authored Jul 18, 2016 by Ashish Jain Committed by Gerrit - the friendly Code Review server Jul 18, 2016

ASoC: msm: qdsp6v2: DAP: Update check to validate data length



A big negative data length value can bypass the current check,
update the condition to ensure that only valid data length is used
to copy the params.

CRs-Fixed: 1041130
Change-Id: I6e1a58e901e4c042acfb0ab0a6223dec2949aefe
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>

parent c44279d0

sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -1523,8 +1523,9 @@ static int msm_ds2_dap_get_param(u32 cmd, void *arg)
		}

		/* Return if invalid length */
		if (dolby_data->length >
		(DOLBY_MAX_LENGTH_INDIVIDUAL_PARAM - DOLBY_PARAM_PAYLOAD_SIZE)) {
		if ((dolby_data->length >
		(DOLBY_MAX_LENGTH_INDIVIDUAL_PARAM - DOLBY_PARAM_PAYLOAD_SIZE)) \|\|
		(dolby_data->length <= 0)) {
		pr_err("Invalid length %d", dolby_data->length);
		rc = -EINVAL;
		goto end;