Browse Source

asoc: Fix invalid size pointer access in routing driver

If data size is not greater than required size
while getting topology in routing driver, it leads
to invalid size pointer access. Add proper
size check to avoid this.

CRs-Fixed: 2384972
Change-Id: I8cd71a4ae866aca57c6d711cfd07e20c5edee3ae
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
Aditya Bavanari 6 years ago
parent
commit
af708a82d1
1 changed files with 5 additions and 0 deletions
  1. 5 0
      asoc/msm-pcm-routing-v2.c

+ 5 - 0
asoc/msm-pcm-routing-v2.c

@@ -23917,6 +23917,11 @@ static uint32_t msm_routing_get_topology(size_t data_size, void *data)
 	uint32_t size = 0;
 
 	/* Retrieve cal_info size from cal data*/
+	if (data_size < sizeof(struct audio_cal_type_basic) +
+			sizeof(struct audio_cal_info_adm_top)) {
+		pr_err("%s: Invalid data size: %zd\n", __func__, data_size);
+		goto done;
+	}
 	size = data_size - sizeof(struct audio_cal_type_basic);
 	cal_info = kzalloc(size, GFP_KERNEL);