lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ASoC: msm-pcm-voip: Avoid interger underflow

Browse Source 
There is no check for voip pkt pkt_len,if it contains the
min required data. This can lead to integer underflow.
Add check for the same.

Change-Id: I4f57eb125967d52ad8da60d21a440af1f81d2579
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
This commit is contained in:
Soumya Managoli 2023-04-17 17:02:59 +05:30
parent fad96773ea
commit 2f6eb70111
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
asoc/msm-pcm-voip-v2.c
View File

@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/init.h>
@ -365,6 +366,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
switch (prtd->mode) {
case MODE_AMR_WB:
case MODE_AMR: {
if (pkt_len <= DSP_FRAME_HDR_LEN) {
pr_err("%s: pkt_len %d is < required len\n",
pkt_len);
spin_unlock_irqrestore(&prtd->dsp_ul_lock,
dsp_flags);
return;
}
/* Remove the DSP frame info header. Header format:
* Bits 0-3: Frame rate
* Bits 4-7: Frame type
@ -385,6 +393,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
case MODE_4GV_NB:
case MODE_4GV_WB:
case MODE_4GV_NW: {
if (pkt_len <= DSP_FRAME_HDR_LEN) {
pr_err("%s: pkt_len %d is < required len\n",
pkt_len);
spin_unlock_irqrestore(&prtd->dsp_ul_lock,
dsp_flags);
return;
}
/* Remove the DSP frame info header.
* Header format:
* Bits 0-3: frame rate
@ -422,6 +437,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
buf_node->frame.frm_hdr.timestamp = timestamp;
voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN;
if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) {
pr_err("%s: pkt_len %d is < required len\n",
pkt_len);
spin_unlock_irqrestore(&prtd->dsp_ul_lock,
dsp_flags);
return;
}
/* There are two frames in the buffer. Length of the
* first frame:
*/