samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "dsp: avtimer: validate payload size before memory copy"

Browse Source
This commit is contained in:
qctecmdr
2019-09-11 08:45:25 -07:00
committed by Gerrit - the friendly Code Review server
parent 018a061578 2e285bf25d
commit 8b6fa0c4b7
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
dsp/avtimer.c
View File

@@ -89,6 +89,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
} }
payload1 = data->payload; payload1 = data->payload;
if (data->payload_size < 2 * sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
switch (payload1[0]) { switch (payload1[0]) {
case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST: case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n", pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
@@ -114,6 +121,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
} }
case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST: case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
if (data->payload_size < sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
payload1 = data->payload; payload1 = data->payload;
pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n", pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
__func__, payload1[0]); __func__, payload1[0]);