evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ASoC: msm: qdsp6v2: Add size check in audio cal ioctl

Browse source 
For the audio get calibration ioctl compare the allocated
buffer size to the size of the header and cal type header
to ensure the buffer is big enough.

Change-Id: I851b4454e8420706ad3263d67e892720d46e5718
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
This commit is contained in:
Ben Romberger 2016-07-14 18:36:56 -07:00 • committed by Gerrit - the friendly Code Review server
parent cc915a3931
commit d0424df41e
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
sound/soc/msm/qdsp6v2/audio_calibration.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
/* Copyright (c) 2014, 2016 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -490,7 +490,13 @@ static long audio_cal_shared_ioctl(struct file *file, unsigned int cmd,
goto unlock;
if (data == NULL)
goto unlock;
if (copy_to_user((void *)arg, data,
if ((sizeof(data->hdr) + data->hdr.cal_type_size) > size) {
pr_err("%s: header size %zd plus cal type size %d are greater than data buffer size %d\n",
__func__, sizeof(data->hdr),
data->hdr.cal_type_size, size);
ret = -EFAULT;
goto unlock;
} else if (copy_to_user((void *)arg, data,
sizeof(data->hdr) + data->hdr.cal_type_size)) {
pr_err("%s: Could not copy cal type to user\n",
__func__);