diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-01-09 01:32:17 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-09 01:32:17 -0800 |
| commit | 3fd4881140f19e97253025f977231ba32dbde5b9 (patch) | |
| tree | aae9d07de406db2dd556cecbf8fdeb4da1241003 | |
| parent | fd9e18a8de3f400545551e95dff6ebb47f408e0d (diff) | |
| parent | 9f91ae0d7203714fc39ae78e1f1c4fd71ed40498 (diff) | |
Merge "drivers: soc: qcom: Add overflow check for sound model size"
| -rw-r--r-- | sound/soc/msm/msm-cpe-lsm.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sound/soc/msm/msm-cpe-lsm.c b/sound/soc/msm/msm-cpe-lsm.c index ef4c9b01d91e..5b90cc11548e 100644 --- a/sound/soc/msm/msm-cpe-lsm.c +++ b/sound/soc/msm/msm-cpe-lsm.c @@ -1878,6 +1878,13 @@ static int msm_cpe_lsm_reg_model(struct snd_pcm_substream *substream, lsm_ops->lsm_get_snd_model_offset(cpe->core_handle, session, &offset); + /* Check if 'p_info->param_size + offset' crosses U32_MAX. */ + if (p_info->param_size > U32_MAX - offset) { + dev_err(rtd->dev, + "%s: Invalid param_size %d\n", + __func__, p_info->param_size); + return -EINVAL; + } session->snd_model_size = p_info->param_size + offset; session->snd_model_data = vzalloc(session->snd_model_size); |