diff options
| author | Soumya Managoli <quic_c_smanag@quicinc.com> | 2023-09-01 13:21:40 +0530 |
|---|---|---|
| committer | Sambandam Chitra <quic_schitra@quicinc.com> | 2023-09-04 02:12:17 -0700 |
| commit | ba5e8087ef4ead484e99b369fc1fdcffa54db1d1 (patch) | |
| tree | a1bbdf05373d830e68ae0aaabc2f4bd617775911 | |
| parent | 73ed2e10eae1d2d7c9ba7d223933e2d9bd101f07 (diff) | |
q6core: Avoid OOB access in q6core
"num_services", a signed integer when compared
with constant results in conversion of signed integer
to max possible unsigned int value when "num_services"
is a negative value. This can lead to OOB read.
Fix is to handle this case.
Change-Id: Id6a8f150d9019c972a87f789e4c626337a97bfff
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/soc/msm/qdsp6v2/q6core.c b/sound/soc/msm/qdsp6v2/q6core.c index 7ac3dcf6281a..a0ecc1ce277c 100644 --- a/sound/soc/msm/qdsp6v2/q6core.c +++ b/sound/soc/msm/qdsp6v2/q6core.c @@ -1,4 +1,5 @@ /* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -87,7 +88,7 @@ static struct generic_get_data_ *generic_get_data; static int parse_fwk_version_info(uint32_t *payload, uint16_t payload_size) { size_t ver_size; - int num_services; + uint16_t num_services; pr_debug("%s: Payload info num services %d\n", __func__, payload[4]); |