diff options
| author | Xiaojun Sang <xsang@codeaurora.org> | 2019-02-12 17:18:18 +0800 |
|---|---|---|
| committer | Xiaojun Sang <xsang@codeaurora.org> | 2019-02-12 17:18:18 +0800 |
| commit | 2bf0c5fb5ecfd8a0a5679326713edc7b56be780f (patch) | |
| tree | f22b3538360e16c7559538b0c48c1111311c6d83 | |
| parent | b2fa9a07421274395a7477d1c159b051cf81d830 (diff) | |
asoc: check payload length against structure size
Payload length must exceed structure size. Otherwise, it may
lead to out-of-boundary memory access.
Change-Id: I090de5116ab04a4ca2b9c485e17617fe9e861ad5
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
| -rw-r--r-- | sound/soc/msm/qdsp6v2/msm-qti-pp-config.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c b/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c index 3dc49e719ccf..769eb9c9853d 100644 --- a/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c +++ b/sound/soc/msm/qdsp6v2/msm-qti-pp-config.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1020,6 +1020,13 @@ int msm_adsp_inform_mixer_ctl(struct snd_soc_pcm_runtime *rtd, } event_data = (struct msm_adsp_event_data *)payload; + if (event_data->payload_len < sizeof(struct msm_adsp_event_data)) { + pr_err("%s: event_data size of %x is less than expected.\n", + __func__, event_data->payload_len); + ret = -EINVAL; + goto done; + } + kctl->info(kctl, &kctl_info); if (event_data->payload_len > |