diff options
| author | Karthikeyan Mani <kmani@codeaurora.org> | 2018-03-06 11:04:49 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-03-09 10:34:18 -0800 |
| commit | 023bc4e0bf2e24367ebf8773b35f31a59a59442e (patch) | |
| tree | c05d49ca2b2880061ce5e1d425b3d962a11bf487 | |
| parent | 07324253e2e621c2cf54105c5612e341a9f305ad (diff) | |
ASoC: msm: qdsp6v2: check for buffer size before read
Check for debugfs ops buf size passed before reading
to eliminate the possibility of reading out of bounds.
Change-Id: I28fd60ce93256b6b0bad62b449092a891cc15463
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6asm.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c index 201234a25bd9..bd7cd45bb98e 100644 --- a/sound/soc/msm/qdsp6v2/q6asm.c +++ b/sound/soc/msm/qdsp6v2/q6asm.c @@ -286,6 +286,11 @@ static ssize_t audio_output_latency_dbgfs_read(struct file *file, pr_err("%s: out_buffer is null\n", __func__); return 0; } + if (count < OUT_BUFFER_SIZE) { + pr_err("%s: read size %d exceeds buf size %zd\n", __func__, + OUT_BUFFER_SIZE, count); + return 0; + } snprintf(out_buffer, OUT_BUFFER_SIZE, "%ld,%ld,%ld,%ld,%ld,%ld,",\ out_cold_tv.tv_sec, out_cold_tv.tv_usec, out_warm_tv.tv_sec,\ out_warm_tv.tv_usec, out_cont_tv.tv_sec, out_cont_tv.tv_usec); @@ -339,6 +344,11 @@ static ssize_t audio_input_latency_dbgfs_read(struct file *file, pr_err("%s: in_buffer is null\n", __func__); return 0; } + if (count < IN_BUFFER_SIZE) { + pr_err("%s: read size %d exceeds buf size %zd\n", __func__, + IN_BUFFER_SIZE, count); + return 0; + } snprintf(in_buffer, IN_BUFFER_SIZE, "%ld,%ld,",\ in_cont_tv.tv_sec, in_cont_tv.tv_usec); return simple_read_from_buffer(buf, IN_BUFFER_SIZE, ppos, |