فهرست منبع

dsp: Add size check for afe set and get functions

In afe_get_cal_sp_th_vi_param and afe_set_cal_sp_th_vi_cfg
functions, data size check is not present which might lead to
out of bounds access. Add size checks to fix the same.

Change-Id: I99eca6065e6f5a050527f1bfce2bfcba28123b53
Signed-off-by: Aditya Bavanari <[email protected]>
Aditya Bavanari 5 سال پیش
والد
کامیت
3c259b5e62
1فایلهای تغییر یافته به همراه2 افزوده شده و 0 حذف شده
  1. 2 0
      dsp/q6afe.c

+ 2 - 0
dsp/q6afe.c

@@ -8456,6 +8456,7 @@ static int afe_set_cal_sp_th_vi_cfg(int32_t cal_type, size_t data_size,
 	uint32_t mode;
 	uint32_t mode;
 
 
 	if (cal_data == NULL ||
 	if (cal_data == NULL ||
+	    data_size != sizeof(*cal_data) ||
 	    this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)
 	    this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)
 		goto done;
 		goto done;
 
 
@@ -8599,6 +8600,7 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size,
 	int ret = 0;
 	int ret = 0;
 
 
 	if (cal_data == NULL ||
 	if (cal_data == NULL ||
+	    data_size != sizeof(*cal_data) ||
 	    this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)
 	    this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL)
 		return 0;
 		return 0;