dsp: avtimer: validate payload size before memory copy
Check payload size to avoid out-of-boundary memory access before attemptimg memory read. Change-Id: I94723b526449aacfe7b2fe30990fb77cdd15c5da Signed-off-by: Ajit Pandey <ajitp@codeaurora.org>
This commit is contained in:
parent
b318271a8b
commit
adbb23f73a
|
@ -1,4 +1,4 @@
|
||||||
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
|
/* Copyright (c) 2012-2016, 2019, The Linux Foundation. All rights reserved.
|
||||||
|
|
||||||
* This program is free software; you can redistribute it and/or modify
|
* This program is free software; you can redistribute it and/or modify
|
||||||
* it under the terms of the GNU General Public License version 2 and
|
* it under the terms of the GNU General Public License version 2 and
|
||||||
|
@ -91,6 +91,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
|
||||||
}
|
}
|
||||||
|
|
||||||
payload1 = data->payload;
|
payload1 = data->payload;
|
||||||
|
|
||||||
|
if (data->payload_size < 2 * sizeof(uint32_t)) {
|
||||||
|
pr_err("%s: payload has invalid size %d\n",
|
||||||
|
__func__, data->payload_size);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
switch (payload1[0]) {
|
switch (payload1[0]) {
|
||||||
case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
|
case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
|
||||||
pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
|
pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
|
||||||
|
@ -116,6 +123,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
|
||||||
}
|
}
|
||||||
|
|
||||||
case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
|
case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
|
||||||
|
if (data->payload_size < sizeof(uint32_t)) {
|
||||||
|
pr_err("%s: payload has invalid size %d\n",
|
||||||
|
__func__, data->payload_size);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
payload1 = data->payload;
|
payload1 = data->payload;
|
||||||
pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
|
pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
|
||||||
__func__, payload1[0]);
|
__func__, payload1[0]);
|
||||||
|
|
Loading…
Reference in New Issue