diff options
| -rw-r--r-- | asoc/codecs/rt5514.c | 2 | ||||
| -rw-r--r-- | dsp/avtimer.c | 12 |
2 files changed, 13 insertions, 1 deletions
diff --git a/asoc/codecs/rt5514.c b/asoc/codecs/rt5514.c index d8aa2bd2..839729ea 100644 --- a/asoc/codecs/rt5514.c +++ b/asoc/codecs/rt5514.c @@ -756,7 +756,7 @@ static int rt5514_ambient_payload_put(struct snd_kcontrol *kcontrol, struct snd_soc_component *component = snd_kcontrol_chip(kcontrol); struct rt5514_priv *rt5514 = snd_soc_component_get_drvdata(component); int ret = 0; - char payload[AMBIENT_COMMON_MAX_PAYLOAD_BUFFER_SIZE]; + char payload[sizeof(RT5514_PAYLOAD)]; unsigned int payload_addr; if (copy_from_user(payload, bytes, size)) diff --git a/dsp/avtimer.c b/dsp/avtimer.c index 10a2964c..a2e745a5 100644 --- a/dsp/avtimer.c +++ b/dsp/avtimer.c @@ -93,6 +93,13 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) } payload1 = data->payload; + + if (data->payload_size < 2 * sizeof(uint32_t)) { + pr_err("%s: payload has invalid size %d\n", + __func__, data->payload_size); + return -EINVAL; + } + switch (payload1[0]) { case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST: pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n", @@ -118,6 +125,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) } case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST: + if (data->payload_size < sizeof(uint32_t)) { + pr_err("%s: payload has invalid size %d\n", + __func__, data->payload_size); + return -EINVAL; + } payload1 = data->payload; pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n", __func__, payload1[0]); |