Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9a2d395 authored by Ben Romberger's avatar Ben Romberger Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: Add bounds checking to ADM get params 



Add additional bounds checking to ADM get params.
Validate that all buffer sizes are valid before
dereferencing.

Change-Id: If7c7a5ae6a56812e9c4a11a38c9bdc78f42d09f3
Signed-off-by: default avatarBen Romberger <bromberg@codeaurora.org>
parent c5353f99

sound/soc/msm/qdsp6v2/q6adm.c

+28 −12
Original line number Diff line number Diff line
@@ -827,10 +827,22 @@ int adm_get_params(int port_id, int copp_idx, uint32_t module_id, 
		rc = -EINVAL;

		goto adm_get_param_return;

	}

	if (params_data) {

	if ((params_data) &&

		(ARRAY_SIZE(adm_get_parameters) >

		idx) &&

		(ARRAY_SIZE(adm_get_parameters) >=

		1+adm_get_parameters[idx]+idx) &&

		(params_length/sizeof(int) >=

		adm_get_parameters[idx])) {

		for (i = 0; i < adm_get_parameters[idx]; i++)

			params_data[i] = adm_get_parameters[1+i+idx];



	} else {

		pr_err("%s: Get param data not copied! get_param array size %zd, index %d, params array size %zd, index %d\n",

		__func__, ARRAY_SIZE(adm_get_parameters),

		(1+adm_get_parameters[idx]+idx),

		params_length/sizeof(int),

		adm_get_parameters[idx]);

	}

	rc = 0;

adm_get_param_return:
@@ -1152,17 +1164,21 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) 
				break;



			idx = ADM_GET_PARAMETER_LENGTH * copp_idx;

			if (payload[0] == 0) {

				if (data->payload_size >

				    (4 * sizeof(uint32_t))) {

			if ((payload[0] == 0) && (data->payload_size >

				(4 * sizeof(*payload))) &&

				(data->payload_size/sizeof(*payload)-4 >=

				payload[3]) &&

				(ARRAY_SIZE(adm_get_parameters) >

				idx) &&

				(ARRAY_SIZE(adm_get_parameters)-idx-1 >=

				payload[3])) {

				adm_get_parameters[idx] = payload[3];

					pr_debug("GET_PP PARAM:received parameter length: 0x%x\n",

						adm_get_parameters[idx]);

				pr_debug("%s: GET_PP PARAM:received parameter length: 0x%x\n",

					__func__, adm_get_parameters[idx]);

				/* storing param size then params */

				for (i = 0; i < payload[3]; i++)

					adm_get_parameters[idx+1+i] =

							payload[4+i];

				}

			} else {

				adm_get_parameters[idx] = -1;

				pr_err("%s: GET_PP_PARAMS failed, setting size to %d\n",