diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-12-19 22:27:53 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-12-19 22:27:53 -0800 |
| commit | e1fe906b59110ddb0847f30085db84434637f045 (patch) | |
| tree | 1de1067d9766e1b602db47e6f5c5f4435561a6e0 | |
| parent | cbd271f8474e02e67e56deb0becc326e1cbcd7ec (diff) | |
| parent | 8e6914531152f65148ac78495e3609bf9a5de582 (diff) | |
Merge "msm: Array bounds check for buffer index"
| -rw-r--r-- | sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c index 0d01803e634d..7e022619c097 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c @@ -183,6 +183,11 @@ static void event_handler(uint32_t opcode, case ASM_DATA_EVENT_READ_DONE_V2: { pr_debug("ASM_DATA_EVENT_READ_DONE_V2\n"); buf_index = q6asm_get_buf_index_from_token(token); + if (buf_index >= CAPTURE_MAX_NUM_PERIODS) { + pr_err("%s: buffer index %u is out of range.\n", + __func__, buf_index); + return; + } pr_debug("%s: token=0x%08x buf_index=0x%08x\n", __func__, token, buf_index); prtd->in_frame_info[buf_index].size = payload[4]; |