evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "drivers: soc: qcom: Add overflow check for sound model size"

Browse source
This commit is contained in:
Linux Build Service Account 2017-01-09 01:32:17 -08:00 • committed by Gerrit - the friendly Code Review server
commit 3fd4881140
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
sound/soc/msm/msm-cpe-lsm.c
View file

@ -1878,6 +1878,13 @@ static int msm_cpe_lsm_reg_model(struct snd_pcm_substream *substream,
lsm_ops->lsm_get_snd_model_offset(cpe->core_handle, lsm_ops->lsm_get_snd_model_offset(cpe->core_handle,
session, &offset); session, &offset);
/* Check if 'p_info->param_size + offset' crosses U32_MAX. */
if (p_info->param_size > U32_MAX - offset) {
dev_err(rtd->dev,
"%s: Invalid param_size %d\n",
__func__, p_info->param_size);
return -EINVAL;
}
session->snd_model_size = p_info->param_size + offset; session->snd_model_size = p_info->param_size + offset;
session->snd_model_data = vzalloc(session->snd_model_size); session->snd_model_data = vzalloc(session->snd_model_size);