diff options
| author | SecurityBot AutoMerger <android-nexus-securitybot@system.gserviceaccount.com> | 2020-03-20 14:13:49 -0700 |
|---|---|---|
| committer | SecurityBot <android-nexus-securitybot@system.gserviceaccount.com> | 2020-03-20 14:13:49 -0700 |
| commit | a0996f97ed54460f490d678ec18c0cab99818a4e (patch) | |
| tree | d1869c686980ae95c0d78d9106406b9018239898 | |
| parent | 50571e566104350c04a2d0da16202c7f9d059f2d (diff) | |
| parent | ee051ba3aa6f504d7a802507f113b8195832e037 (diff) | |
| download | msm-extra-a0996f97ed54460f490d678ec18c0cab99818a4e.tar.gz | |
Merge android-msm-pixel-4.9-qt-qpr3 into android-msm-pixel-4.9android-r-preview-3_r0.5android-r-preview-3_r0.3android-msm-crosshatch-4.9-r-preview-3android-msm-bonito-4.9-r-preview-3
SBMerger: 284775313
Change-Id: I7051c106895dba4fe060d8109daedb9dcf4f5b89
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
| -rw-r--r-- | asoc/codecs/rt5514.c | 2 | ||||
| -rw-r--r-- | dsp/avtimer.c | 12 |
2 files changed, 13 insertions, 1 deletions
diff --git a/asoc/codecs/rt5514.c b/asoc/codecs/rt5514.c index d8aa2bd2..839729ea 100644 --- a/asoc/codecs/rt5514.c +++ b/asoc/codecs/rt5514.c @@ -756,7 +756,7 @@ static int rt5514_ambient_payload_put(struct snd_kcontrol *kcontrol, struct snd_soc_component *component = snd_kcontrol_chip(kcontrol); struct rt5514_priv *rt5514 = snd_soc_component_get_drvdata(component); int ret = 0; - char payload[AMBIENT_COMMON_MAX_PAYLOAD_BUFFER_SIZE]; + char payload[sizeof(RT5514_PAYLOAD)]; unsigned int payload_addr; if (copy_from_user(payload, bytes, size)) diff --git a/dsp/avtimer.c b/dsp/avtimer.c index 10a2964c..a2e745a5 100644 --- a/dsp/avtimer.c +++ b/dsp/avtimer.c @@ -93,6 +93,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) } payload1 = data->payload; + + if (data->payload_size < 2 * sizeof(uint32_t)) { + pr_err("%s: payload has invalid size %d\n", + __func__, data->payload_size); + return -EINVAL; + } + switch (payload1[0]) { case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST: pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n", @@ -118,6 +125,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) } case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST: + if (data->payload_size < sizeof(uint32_t)) { + pr_err("%s: payload has invalid size %d\n", + __func__, data->payload_size); + return -EINVAL; + } payload1 = data->payload; pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n", __func__, payload1[0]); |