Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

Asoc:msm:Added Buffer overflow check

Browse source 
The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Bug: 28751152
Change-Id: I79b7e5f875fadcaeceb05f9163ae3666d4b6b7e1
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
This commit is contained in:
Mohammad Johny Shaik 2013-12-12 14:26:42 +05:30 committed by Thierry Strudel
parent 6bcdea884d
commit 24147c05f0
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
arch/arm/mach-msm/qdsp6v2/audio_utils.c
View file

@ -23,6 +23,7 @@
#include <asm/ioctls.h>
#include "audio_utils.h"
#define FRAME_SIZE (1 + ((1536+sizeof(struct meta_out_dsp)) * 5))
static int audio_in_pause(struct q6audio_in *audio)
{
int rc;
@ -257,6 +258,11 @@ long audio_in_ioctl(struct file *file,
rc = -EINVAL;
break;
}
if ((cfg.buffer_size > FRAME_SIZE) ||
(cfg.buffer_count != FRAME_NUM)) {
rc = -EINVAL;
break;
}
audio->str_cfg.buffer_size = cfg.buffer_size;
audio->str_cfg.buffer_count = cfg.buffer_count;
rc = q6asm_audio_client_buf_alloc(OUT, audio->ac,

3
sound/soc/msm/qdsp6v2/q6asm.c
View file

@ -55,6 +55,7 @@
#define READDONE_IDX_FLAGS 8
#define READDONE_IDX_NUMFRAMES 9
#define READDONE_IDX_SEQ_ID 10
#define FRAME_NUM (8)
/* TODO, combine them together */
static DEFINE_MUTEX(session_lock);
@ -608,6 +609,8 @@ int q6asm_audio_client_buf_alloc(unsigned int dir,
pr_debug("%s: buffer already allocated\n", __func__);
return 0;
}
if (bufcnt != FRAME_NUM)
goto fail;
mutex_lock(&ac->cmd_lock);
buf = kzalloc(((sizeof(struct audio_buffer))*bufcnt),
GFP_KERNEL);