Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-10-31 18:09:19 +00:00
Code Issues Projects Releases Wiki Activity

drivers: soc: qcom: Add overflow check in ADM driver

Browse source 
Add overflow check for param length to prevent
heap overflow while allocating memory for
ADM parameters.

CRs-Fixed: 1103334
Change-Id: I1163aeaabbc84dba4cd0739a35ecbdee18b42717
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
This commit is contained in:
Karthik Reddy Katta 2017-01-03 11:09:05 +05:30 committed by Shreyas Narayan
parent 29f346365d
commit e023a636d2
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
sound/soc/msm/qdsp6v2/q6adm.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2014, 2016, 2017 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -969,9 +969,10 @@ int adm_get_params_v2(int port_id, int copp_idx, uint32_t module_id,
char *params, uint32_t client_id)
{
struct adm_cmd_get_pp_params_v5 *adm_params = NULL;
int sz, rc = 0, i = 0;
int rc = 0, i = 0;
int port_idx, idx;
int *params_data = (int *)params;
uint64_t sz = 0;
port_id = afe_convert_virtual_to_portid(port_id);
port_idx = adm_validate_and_get_port_index(port_id);
@ -980,7 +981,16 @@ int adm_get_params_v2(int port_id, int copp_idx, uint32_t module_id,
return -EINVAL;
}
sz = sizeof(struct adm_cmd_get_pp_params_v5) + params_length;
sz = (uint64_t)sizeof(struct adm_cmd_get_pp_params_v5) +
(uint64_t)params_length;
/*
* Check if the value of "sz" (which is ultimately assigned to
* "hdr.pkt_size") crosses U16_MAX.
*/
if (sz > U16_MAX) {
pr_err("%s: Invalid params_length\n", __func__);
return -EINVAL;
}
adm_params = kzalloc(sz, GFP_KERNEL);
if (!adm_params) {
pr_err("%s: adm params memory alloc failed", __func__);