evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ASoC: msm: qdsp6v2: check for buffer size before read

Browse source 
Check for debugfs ops buf size passed before reading
to eliminate the possibility of reading out of bounds.

Change-Id: I28fd60ce93256b6b0bad62b449092a891cc15463
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
This commit is contained in:
Karthikeyan Mani 2018-03-06 11:04:49 -08:00 • committed by Gerrit - the friendly Code Review server
parent 07324253e2
commit 023bc4e0bf
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
sound/soc/msm/qdsp6v2/q6asm.c
View file

@ -286,6 +286,11 @@ static ssize_t audio_output_latency_dbgfs_read(struct file *file,
pr_err("%s: out_buffer is null\n", __func__);
return 0;
}
if (count < OUT_BUFFER_SIZE) {
pr_err("%s: read size %d exceeds buf size %zd\n", __func__,
OUT_BUFFER_SIZE, count);
return 0;
}
snprintf(out_buffer, OUT_BUFFER_SIZE, "%ld,%ld,%ld,%ld,%ld,%ld,",\
out_cold_tv.tv_sec, out_cold_tv.tv_usec, out_warm_tv.tv_sec,\
out_warm_tv.tv_usec, out_cont_tv.tv_sec, out_cont_tv.tv_usec);
@ -339,6 +344,11 @@ static ssize_t audio_input_latency_dbgfs_read(struct file *file,
pr_err("%s: in_buffer is null\n", __func__);
return 0;
}
if (count < IN_BUFFER_SIZE) {
pr_err("%s: read size %d exceeds buf size %zd\n", __func__,
IN_BUFFER_SIZE, count);
return 0;
}
snprintf(in_buffer, IN_BUFFER_SIZE, "%ld,%ld,",\
in_cont_tv.tv_sec, in_cont_tv.tv_usec);
return simple_read_from_buffer(buf, IN_BUFFER_SIZE, ppos,