diff options
| author | Soumya Managoli <quic_c_smanag@quicinc.com> | 2023-08-17 17:18:12 +0530 |
|---|---|---|
| committer | Sambandam Chitra <quic_schitra@quicinc.com> | 2023-09-04 02:07:22 -0700 |
| commit | d9c2df9283791e54179591ae7d9b4445200412d7 (patch) | |
| tree | 8438da6a9f5557047a298ffdaf136d4fd7272df0 | |
| parent | 73ed2e10eae1d2d7c9ba7d223933e2d9bd101f07 (diff) | |
q6voice: Add buf size check for cvs cal data.
Check for the max size of cvs command register
calibration data that can be copied else will
result in buffer overflow.
Change-Id: Id7a4c5a9795143798b68dfde779f17fb450e3848
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
(cherry picked from commit 606e2a66f0cd284cfe0d445230b45430b99578e8)
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6voice.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/q6voice.c b/sound/soc/msm/qdsp6v2/q6voice.c index e86337dbab1d..2f8e76844a67 100644 --- a/sound/soc/msm/qdsp6v2/q6voice.c +++ b/sound/soc/msm/qdsp6v2/q6voice.c @@ -2545,6 +2545,13 @@ static int voice_send_cvs_register_cal_cmd(struct voice_data *v) goto unlock; } + if (col_data->cal_data.size > MAX_COL_INFO_SIZE) { + pr_err("%s: Invalid cal data size %zu!\n", + __func__, col_data->cal_data.size); + ret = -EINVAL; + goto unlock; + } + memcpy(&cvs_reg_cal_cmd.cvs_cal_data.column_info[0], (void *) &((struct audio_cal_info_voc_col *) col_data->cal_info)->data, |