diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2023-09-06 04:29:42 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2023-09-06 04:29:40 -0700 |
| commit | 6f0803ebd8bbdd4492e38dc19b5c91639d191b55 (patch) | |
| tree | 24bf24a0b753a4e3c0b19710554564ece5e05412 | |
| parent | cb118324aad84e38027a3ab4b947b91274ff2ec0 (diff) | |
| parent | 7f5bd7bd2b8863e4053b3deb650ebfb61dbd9dcc (diff) | |
Merge "dsp: afe: Add check for sidetone iir config copy size."
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6afe.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/q6afe.c b/sound/soc/msm/qdsp6v2/q6afe.c index 610604fcfe15..21370dbadb5b 100644 --- a/sound/soc/msm/qdsp6v2/q6afe.c +++ b/sound/soc/msm/qdsp6v2/q6afe.c @@ -5475,6 +5475,13 @@ static int afe_sidetone_iir(u16 tx_port_id) pr_debug("%s: adding 2 to size:%d\n", __func__, size); size = size + 2; } + + if (size > MAX_SIDETONE_IIR_DATA_SIZE) { + pr_err("%s: iir_config size is out of bounds:%d\n", __func__, size); + mutex_unlock(&this_afe.cal_data[cal_index]->lock); + ret = -EINVAL; + goto done; + } memcpy(&filter_data.iir_config, &st_iir_cal_info->iir_config, size); mutex_unlock(&this_afe.cal_data[cal_index]->lock); |