Quellcode durchsuchen

msm: ADSPRPC: Avoid Out-Of-Bounds access

Currently, when adding duplicate sessions to an array that holds
session information, no check is performed to avoid going out of
bounds. Add a check to confirm that the index is not out of bounds.

Change-Id: Ib7abcc5347ba49a8c787ec32e8519a11085456d9
Signed-off-by: quic_anane <[email protected]>
quic_anane vor 8 Monaten
Ursprung
Commit
2466bcf3ce
1 geänderte Dateien mit 6 neuen und 0 gelöschten Zeilen
  1. 6 0
      dsp/adsprpc.c

+ 6 - 0
dsp/adsprpc.c

@@ -8172,6 +8172,12 @@ static int fastrpc_cb_probe(struct device *dev)
 			for (j = 1; j < sharedcb_count &&
 					chan->sesscount < NUM_SESSIONS; j++) {
 				chan->sesscount++;
+				VERIFY(err, chan->sesscount < NUM_SESSIONS);
+				if (err) {
+					ADSPRPC_WARN("failed to add shared session, maximum sessions (%d) reached \n",
+						NUM_SESSIONS);
+					break;
+				}
 				dup_sess = &chan->session[chan->sesscount];
 				memcpy(dup_sess, sess,
 					sizeof(struct fastrpc_session_ctx));