Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9131484 authored by Ben Romberger's avatar Ben Romberger Committed by Shreyas Narayan
Browse files

ASoC : msm: qdsp6v2: Add size check in audio cal ioctl 



For the audio get calibration ioctl compare the allocated
buffer size to the size of the header and cal type header
to ensure the buffer is big enough.

CRs-Fixed: 1038127
Change-Id: I851b4454e8420706ad3263d67e892720d46e5718
Signed-off-by: default avatarBen Romberger <bromberg@codeaurora.org>
parent fc05c1c4

sound/soc/msm/qdsp6v2/audio_calibration.c

+8 −2
Original line number Original line Diff line number Diff line 
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and
@@ -494,7 +494,13 @@ static long audio_cal_shared_ioctl(struct file *file, unsigned int cmd, 
			goto unlock;

			goto unlock;

		if (data == NULL)

		if (data == NULL)

			goto unlock;

			goto unlock;

		if (copy_to_user((void *)arg, data,

		if ((sizeof(data->hdr) + data->hdr.cal_type_size) > size) {

			pr_err("%s: header size %zd plus cal type size %d are greater than data buffer size %d\n",

				__func__, sizeof(data->hdr),

				data->hdr.cal_type_size, size);

			ret = -EFAULT;

			goto unlock;

		} else if (copy_to_user((void *)arg, data,

			sizeof(data->hdr) + data->hdr.cal_type_size)) {

			sizeof(data->hdr) + data->hdr.cal_type_size)) {

			pr_err("%s: Could not copy cal type to user\n",

			pr_err("%s: Could not copy cal type to user\n",

				__func__);

				__func__);