evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ASoC: msm: qdsp6v2: DAP: Update check to validate data length

Browse source 
A big negative data length value can bypass the current check,
update the condition to ensure that only valid data length is used
to copy the params.

CRs-Fixed: 1041130
Change-Id: I6e1a58e901e4c042acfb0ab0a6223dec2949aefe
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
This commit is contained in:
Ashish Jain 2016-07-18 16:07:42 +05:30 • committed by Gerrit - the friendly Code Review server
parent 9e4b3ba4af
commit e9276dfdcd
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c
View file

@ -1523,8 +1523,9 @@ static int msm_ds2_dap_get_param(u32 cmd, void *arg)
} }
/* Return if invalid length */ /* Return if invalid length */
if (dolby_data->length > if ((dolby_data->length >
(DOLBY_MAX_LENGTH_INDIVIDUAL_PARAM - DOLBY_PARAM_PAYLOAD_SIZE)) { (DOLBY_MAX_LENGTH_INDIVIDUAL_PARAM - DOLBY_PARAM_PAYLOAD_SIZE)) ||
(dolby_data->length <= 0)) {
pr_err("Invalid length %d", dolby_data->length); pr_err("Invalid length %d", dolby_data->length);
rc = -EINVAL; rc = -EINVAL;
goto end; goto end;