Kaynağa Gözat

msm: ADSPRPC: Avoid Out-Of-Bounds access

Currently, when adding duplicate sessions to an array that holds
session information, no check is performed to avoid going out of
bounds. Add a check to confirm that the index is not out of bounds.

Change-Id: Ib7abcc5347ba49a8c787ec32e8519a11085456d9
Signed-off-by: quic_anane <[email protected]>
quic_anane 8 ay önce
ebeveyn
işleme
2466bcf3ce
1 değiştirilmiş dosya ile 6 ekleme ve 0 silme
  1. 6 0
      dsp/adsprpc.c

+ 6 - 0
dsp/adsprpc.c

@@ -8172,6 +8172,12 @@ static int fastrpc_cb_probe(struct device *dev)
 			for (j = 1; j < sharedcb_count &&
 					chan->sesscount < NUM_SESSIONS; j++) {
 				chan->sesscount++;
+				VERIFY(err, chan->sesscount < NUM_SESSIONS);
+				if (err) {
+					ADSPRPC_WARN("failed to add shared session, maximum sessions (%d) reached \n",
+						NUM_SESSIONS);
+					break;
+				}
 				dup_sess = &chan->session[chan->sesscount];
 				memcpy(dup_sess, sess,
 					sizeof(struct fastrpc_session_ctx));