Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-10-31 18:09:19 +00:00
Code Issues Projects Releases Wiki Activity

ASoC: msm: qdsp6v2: DAP: Add check to validate param length

Browse source 
To avoid buffer overflow, validate input length used to
fetch visualizer data.

CRs-Fixed: 1033540
Change-Id: I445d1ba3bce47308bc31ae24a70d5ee358f22a2d
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
This commit is contained in:
Ashish Jain 2016-07-01 12:31:21 +05:30 committed by Gerrit - the friendly Code Review server
parent ff694c5bf8
commit 952e938f8c
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sound/soc/msm/qdsp6v2/msm-dolby-common.h
View file

@ -1,5 +1,5 @@
/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
/* Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
* only version 2 as published by the Free Software Foundation.
@ -232,6 +232,7 @@
#define TOTAL_LENGTH_DOLBY_PARAM 745
#define DOLBY_VIS_PARAM_HEADER_SIZE 25
#define DOLBY_PARAM_VCNB_MAX_LENGTH 40
#define DOLBY_INVALID_PORT_ID -1

7
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c
View file

@ -1627,6 +1627,13 @@ static int msm_ds2_dap_param_visualizer_control_get(u32 cmd, void *arg)
}
length = ds2_dap_params[cache_dev].params_val[DOLBY_PARAM_VCNB_OFFSET];
if (length > DOLBY_PARAM_VCNB_MAX_LENGTH || length <= 0) {
ret = 0;
dolby_data->length = 0;
pr_err("%s Incorrect VCNB length", __func__);
}
params_length = (2*length + DOLBY_VIS_PARAM_HEADER_SIZE) *
sizeof(uint32_t);