diff options
| author | qctecmdr <qctecmdr@localhost> | 2021-03-21 19:17:42 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2021-03-21 19:17:42 -0700 |
| commit | b0bf9aab325803d62c1d7f042d7ef877e2189387 (patch) | |
| tree | f26ba70f937079cfbfafba0cf35fe2e0bc95650c | |
| parent | e4c6762dbd22f4290839ce63165dccfbdaf4e9bc (diff) | |
| parent | 34df55a3bd442a10cb6839bb729bfb08dc0e8c93 (diff) | |
| download | msm-extra-b0bf9aab325803d62c1d7f042d7ef877e2189387.tar.gz | |
Merge "dsp: update size check for get VI param function"
| -rw-r--r-- | dsp/q6afe.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/dsp/q6afe.c b/dsp/q6afe.c index 88124df9..7f594f29 100644 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -10160,6 +10160,7 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size, if (cal_data == NULL || data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr) || this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL) return 0; @@ -10188,7 +10189,8 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL || cal_data == NULL || - data_size != sizeof(*cal_data)) + data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock); @@ -10255,7 +10257,8 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL || cal_data == NULL || - data_size != sizeof(*cal_data)) + data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock); |