dsp: q6asm: Add check for ADSP payload size
There is no check for the ADSP returned payload size for ASM_SESSION_CMD_GET_MTMX_STRTR_PARAMS_V2 cmd response. This can lead to buffer overread. Fix is to address this. Change-Id: I0bd6ee7f19823addc5dde1dfbb32b8a9b102a725 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
This commit is contained in:
parent
1c04162edc
commit
9c91c3d179
11
dsp/q6asm.c
11
dsp/q6asm.c
@ -2551,7 +2551,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
|
||||
__func__, data->payload_size);
|
||||
break;
|
||||
case ASM_SESSION_CMDRSP_GET_MTMX_STRTR_PARAMS_V2:
|
||||
q6asm_process_mtmx_get_param_rsp(ac, (void *) payload);
|
||||
payload_size = sizeof(struct asm_mtmx_strtr_get_params_cmdrsp);
|
||||
if (data->payload_size < payload_size) {
|
||||
pr_err("%s: insufficient payload size = %d\n",
|
||||
__func__, data->payload_size);
|
||||
spin_unlock_irqrestore(
|
||||
&(session[session_id].session_lock), flags);
|
||||
return -EINVAL;
|
||||
}
|
||||
q6asm_process_mtmx_get_param_rsp(ac,
|
||||
(struct asm_mtmx_strtr_get_params_cmdrsp *) payload);
|
||||
break;
|
||||
case ASM_STREAM_PP_EVENT:
|
||||
case ASM_STREAM_CMD_ENCDEC_EVENTS:
|
||||
|
Loading…
Reference in New Issue
Block a user