samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

asoc: codecs: wcd938x: limit buffer copy to max buffer size

Browse Source 
Check for max buffer size before filling the buffer and
add error handling for cases where buffer copy fails.

Change-Id: I0eede1e5baf63c35c65a704c8bf53c85fe49892e
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
This commit is contained in:
Karthikeyan Mani
2019-09-27 14:03:05 -07:00
parent 6fc4b30d6b
commit 80b063e8d9
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
asoc/codecs/wcd938x/wcd938x-slave.c
View File

@@ -112,9 +112,9 @@ static ssize_t wcd938x_swrslave_reg_show(struct swr_device *pdev,
if (!is_swr_slv_reg_readable(i)) if (!is_swr_slv_reg_readable(i))
continue; continue;
swr_read(pdev, pdev->dev_num, i, &reg_val, 1); swr_read(pdev, pdev->dev_num, i, &reg_val, 1);
len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i, len = snprintf(tmp_buf, sizeof(tmp_buf), "0x%.3x: 0x%.2x\n", i,
(reg_val & 0xFF)); (reg_val & 0xFF));
if ((total + len) >= count - 1) if (((total + len) >= count - 1) || (len < 0))
break; break;
if (copy_to_user((ubuf + total), tmp_buf, len)) { if (copy_to_user((ubuf + total), tmp_buf, len)) {
pr_err("%s: fail to copy reg dump\n", __func__); pr_err("%s: fail to copy reg dump\n", __func__);