diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-09 03:12:05 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-09 03:12:04 -0800 |
| commit | dd6494d94ef819c093157f73a314e9927305d305 (patch) | |
| tree | fc13b2b3b8945451baa84cde482e553703afbb02 | |
| parent | f357214ebe2722dcb3f84308ed24bf965e2c15a9 (diff) | |
| parent | a50d25f41c4270c340436ee7757c443375eb887c (diff) | |
Merge "ASoC: codecs: fix out of bounds copy"
| -rw-r--r-- | sound/soc/codecs/msm_hdmi_codec_rx.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/sound/soc/codecs/msm_hdmi_codec_rx.c b/sound/soc/codecs/msm_hdmi_codec_rx.c index 7d649ba2b505..8ae789a90f33 100644 --- a/sound/soc/codecs/msm_hdmi_codec_rx.c +++ b/sound/soc/codecs/msm_hdmi_codec_rx.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -85,6 +85,15 @@ static int msm_ext_disp_edid_get(struct snd_kcontrol *kcontrol, rc = codec_data->ext_disp_ops.get_audio_edid_blk( codec_data->ext_disp_core_pdev, &edid_blk); if (!IS_ERR_VALUE(rc)) { + if (sizeof(ucontrol->value.bytes.data) < + (edid_blk.audio_data_blk_size + + edid_blk.spk_alloc_data_blk_size)) { + dev_err(codec->dev, + "%s: Not enough memory to copy EDID data\n", + __func__); + return -ENOMEM; + } + memcpy(ucontrol->value.bytes.data, edid_blk.audio_data_blk, edid_blk.audio_data_blk_size); |