diff --git a/sound/soc/msm/qdsp6v2/msm-dolby-common.h b/sound/soc/msm/qdsp6v2/msm-dolby-common.h index aab6dc825a23..f14e42e3faa0 100644 --- a/sound/soc/msm/qdsp6v2/msm-dolby-common.h +++ b/sound/soc/msm/qdsp6v2/msm-dolby-common.h @@ -1,5 +1,5 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved. * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and * only version 2 as published by the Free Software Foundation. @@ -232,6 +232,7 @@ #define TOTAL_LENGTH_DOLBY_PARAM 745 #define DOLBY_VIS_PARAM_HEADER_SIZE 25 +#define DOLBY_PARAM_VCNB_MAX_LENGTH 40 #define DOLBY_INVALID_PORT_ID -1 diff --git a/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c b/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c index ace747dd9bde..7b04baf2e4ee 100644 --- a/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c +++ b/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c @@ -1627,6 +1627,13 @@ static int msm_ds2_dap_param_visualizer_control_get(u32 cmd, void *arg) } length = ds2_dap_params[cache_dev].params_val[DOLBY_PARAM_VCNB_OFFSET]; + + if (length > DOLBY_PARAM_VCNB_MAX_LENGTH || length <= 0) { + ret = 0; + dolby_data->length = 0; + pr_err("%s Incorrect VCNB length", __func__); + } + params_length = (2*length + DOLBY_VIS_PARAM_HEADER_SIZE) * sizeof(uint32_t);