diff options
| author | Siena Richard <sienar@codeaurora.org> | 2016-07-12 13:55:45 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-07-14 12:43:56 -0700 |
| commit | 5feda7e4585af321fa766906dc506ef9aaa9568a (patch) | |
| tree | 2fe5f338dfac4af16b6ab4a4631332e943baf16f /drivers | |
| parent | aa958278d16faccd0cc79650b94ea6aa18d4131d (diff) | |
ASoc: msm: fix out of bounds array access
Check that the array index value is less than the max array size
to avoid an out of bounds array access.
CRs-Fixed: 1037903
Change-Id: I2e357fd60c03833aed48a815794729fabfcfcf93
Signed-off-by: Siena Richard <sienar@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/misc/qcom/qdsp6v2/q6audio_v2.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/misc/qcom/qdsp6v2/q6audio_v2.c b/drivers/misc/qcom/qdsp6v2/q6audio_v2.c index 7eb6629b1e57..51ba23da1270 100644 --- a/drivers/misc/qcom/qdsp6v2/q6audio_v2.c +++ b/drivers/misc/qcom/qdsp6v2/q6audio_v2.c @@ -85,6 +85,13 @@ void audio_in_get_dsp_frames(void *priv, pr_debug("%s:session id %d: enc_framesotal_size=0x%8x\n", __func__, audio->ac->session, payload[4]); + /* Ensure the index is within max array size: FRAME_NUM */ + if (index >= FRAME_NUM) { + pr_err("%s: Invalid index %d\n", + __func__, index); + return; + } + audio->out_frame_info[index][0] = payload[9]; audio->out_frame_info[index][1] = payload[5]; |