diff options
| author | Harshal Ahire <hahire@codeaurora.org> | 2021-01-12 17:09:34 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2021-01-30 04:45:59 -0800 |
| commit | 8165cfdabdd8f15c63bea533054560a4299bb019 (patch) | |
| tree | 94b2477002223d98cf1f69b92ca5d14577422291 /asoc | |
| parent | 989605a308e760bc4e65bf8a70eace857c627535 (diff) | |
| download | msm-extra-8165cfdabdd8f15c63bea533054560a4299bb019.tar.gz | |
asoc: Add check to handle negative value passed for num_app_cfg_type
Long int negative value passed as part of ucontrol structure
is assigned to int num_app_cfg_type making it positive and
leading to overflow while populating maximum supported
lsm_app_type_cfg structures.
Change-Id: I81e3c75eea82265c8e8e1b3f8f95d9e334c895c4
Signed-off-by: Harshal Ahire <hahire@codeaurora.org>
Diffstat (limited to 'asoc')
| -rw-r--r-- | asoc/msm-pcm-routing-v2.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/asoc/msm-pcm-routing-v2.c b/asoc/msm-pcm-routing-v2.c index 37635a84..7aafe2b9 100644 --- a/asoc/msm-pcm-routing-v2.c +++ b/asoc/msm-pcm-routing-v2.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. */ #include <linux/init.h> @@ -22773,9 +22773,9 @@ static int msm_routing_put_app_type_cfg_control(struct snd_kcontrol *kcontrol, memset(app_type_cfg, 0, MAX_APP_TYPES* sizeof(struct msm_pcm_routing_app_type_data)); - if (num_app_types > MAX_APP_TYPES) { - pr_err("%s: number of app types exceed the max supported\n", - __func__); + if (num_app_types > MAX_APP_TYPES || num_app_types < 0) { + pr_err("%s: number of app types %d is invalid\n", + __func__, num_app_types); return -EINVAL; } for (j = 0; j < num_app_types; j++) { @@ -22979,9 +22979,10 @@ static int msm_routing_put_lsm_app_type_cfg_control( int i = 0, j; mutex_lock(&routing_lock); - if (ucontrol->value.integer.value[0] > MAX_APP_TYPES) { - pr_err("%s: number of app types exceed the max supported\n", - __func__); + if (ucontrol->value.integer.value[0] < 0 || + ucontrol->value.integer.value[0] > MAX_APP_TYPES) { + pr_err("%s: number of app types %ld is invalid\n", + __func__, ucontrol->value.integer.value[0]); mutex_unlock(&routing_lock); return -EINVAL; } |