mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-10-31 18:09:19 +00:00
ASoC: msm: qdsp6v2: check for buffer size before read
Check for debugfs ops buf size passed before reading to eliminate the possibility of reading out of bounds. Bug: 77528653 Change-Id: I28fd60ce93256b6b0bad62b449092a891cc15463 Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
This commit is contained in:
parent
2064355d47
commit
078d3912e5
1 changed files with 10 additions and 0 deletions
|
@ -139,6 +139,11 @@ static ssize_t audio_output_latency_dbgfs_read(struct file *file,
|
|||
pr_err("%s: out_buffer is null\n", __func__);
|
||||
return 0;
|
||||
}
|
||||
if (count < OUT_BUFFER_SIZE) {
|
||||
pr_err("%s: read size %d exceeds buf size %zd\n", __func__,
|
||||
OUT_BUFFER_SIZE, count);
|
||||
return 0;
|
||||
}
|
||||
snprintf(out_buffer, OUT_BUFFER_SIZE, "%ld,%ld,%ld,%ld,%ld,%ld,",\
|
||||
out_cold_tv.tv_sec, out_cold_tv.tv_usec, out_warm_tv.tv_sec,\
|
||||
out_warm_tv.tv_usec, out_cont_tv.tv_sec, out_cont_tv.tv_usec);
|
||||
|
@ -192,6 +197,11 @@ static ssize_t audio_input_latency_dbgfs_read(struct file *file,
|
|||
pr_err("%s: in_buffer is null\n", __func__);
|
||||
return 0;
|
||||
}
|
||||
if (count < IN_BUFFER_SIZE) {
|
||||
pr_err("%s: read size %d exceeds buf size %zd\n", __func__,
|
||||
IN_BUFFER_SIZE, count);
|
||||
return 0;
|
||||
}
|
||||
snprintf(in_buffer, IN_BUFFER_SIZE, "%ld,%ld,",\
|
||||
in_cont_tv.tv_sec, in_cont_tv.tv_usec);
|
||||
return simple_read_from_buffer(buf, IN_BUFFER_SIZE, ppos,
|
||||
|
|
Loading…
Reference in a new issue