evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ASoC: msm: audio-effects: fix stack overread and heap overwrite

Browse source 
Fix overwrite of updt_params allocated in heap, and stack overread
where param pointer is passed from user space.

CRs-Fixed: 989628
Change-Id: Ida8bdb7da2fcb97023dce3b6eafe4b899a51cb66
Signed-off-by: Weiyin Jiang <wjiang@codeaurora.org>
This commit is contained in:
Weiyin Jiang 2016-03-16 12:51:03 +08:00 • committed by Jeevan Shriram
parent 05a8698e52
commit 7966b0d08e
4 changed files with 608 additions and 276 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c
View file

@ -20,7 +20,6 @@
#include <sound/msm-dts-eagle.h>
#define MAX_CHANNELS_SUPPORTED 8
#define MAX_PP_PARAMS_SZ 128
#define WAIT_TIMEDOUT_DURATION_SECS 1
struct q6audio_effects {

4
include/sound/msm-audio-effects-q6-v2.h
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -16,6 +16,8 @@
#include <sound/audio_effects.h>
#define MAX_PP_PARAMS_SZ 128
bool msm_audio_effects_is_effmodule_supp_in_top(int effect_module,
int topology);

877
sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c
View file

File diff suppressed because it is too large Load diff

2
sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
View file

@ -2857,7 +2857,7 @@ static int msm_compr_audio_effects_config_info(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_info *uinfo)
{
uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
uinfo->count = 128;
uinfo->count = MAX_PP_PARAMS_SZ;
uinfo->value.integer.min = 0;
uinfo->value.integer.max = 0xFFFFFFFF;
return 0;