Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6678bc64 authored by Harshal Ahire's avatar Harshal Ahire Committed by Gerrit - the friendly Code Review server
Browse files

asoc: Add check to handle negative value passed for num_app_cfg_type 



Long int negative value passed as part of ucontrol structure
is assigned to int num_app_cfg_type making it positive and
leading to overflow while populating maximum supported
lsm_app_type_cfg structures.

Change-Id: I81e3c75eea82265c8e8e1b3f8f95d9e334c895c4
Signed-off-by: default avatarHarshal Ahire <hahire@codeaurora.org>
Signed-off-by: default avatarRamu Gottipati <ramug@codeaurora.org>
parent e86eb597

asoc/msm-pcm-routing-v2.c

+8 −7
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -17246,9 +17246,9 @@ static int msm_routing_put_app_type_cfg_control(struct snd_kcontrol *kcontrol, 








	memset(app_type_cfg, 0, MAX_APP_TYPES*









				sizeof(struct msm_pcm_routing_app_type_data));









	if (num_app_types > MAX_APP_TYPES) {









		pr_err("%s: number of app types exceed the max supported\n",









			__func__);









	if (num_app_types > MAX_APP_TYPES || num_app_types < 0) {









		pr_err("%s: number of app types %d is invalid\n",









			__func__, num_app_types) ;









		return -EINVAL;









	}









	for (j = 0; j < num_app_types; j++) {








@@ -17453,9 +17453,10 @@ static int msm_routing_put_lsm_app_type_cfg_control(







	int num_app_types;

















	mutex_lock(&routing_lock);









	if (ucontrol->value.integer.value[0] > MAX_APP_TYPES) {









		pr_err("%s: number of app types exceed the max supported\n",









			__func__);









	if (ucontrol->value.integer.value[0] < 0 ||









		ucontrol->value.integer.value[0] > MAX_APP_TYPES) {









		pr_err("%s: number of app types %ld is invalid\n",









			__func__, ucontrol->value.integer.value[0]);









		mutex_unlock(&routing_lock);









		return -EINVAL;









	}