lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dsp: q6asm: Add check for ADSP payload size

Browse Source 
There is no check for the ADSP returned payload size
for ASM_SESSION_CMD_GET_MTMX_STRTR_PARAMS_V2 cmd response.
This can lead to buffer overread. Fix is to address this.

Change-Id: I0bd6ee7f19823addc5dde1dfbb32b8a9b102a725
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
This commit is contained in:
Soumya Managoli 2023-08-04 14:49:34 +05:30 committed by Gerrit - the friendly Code Review server
parent 1c04162edc
commit 9c91c3d179
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
dsp/q6asm.c
View File

@ -2551,7 +2551,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
__func__, data->payload_size);
break;
case ASM_SESSION_CMDRSP_GET_MTMX_STRTR_PARAMS_V2:
q6asm_process_mtmx_get_param_rsp(ac, (void *) payload);
payload_size = sizeof(struct asm_mtmx_strtr_get_params_cmdrsp);
if (data->payload_size < payload_size) {
pr_err("%s: insufficient payload size = %d\n",
__func__, data->payload_size);
spin_unlock_irqrestore(
&(session[session_id].session_lock), flags);
return -EINVAL;
}
q6asm_process_mtmx_get_param_rsp(ac,
(struct asm_mtmx_strtr_get_params_cmdrsp *) payload);
break;
case ASM_STREAM_PP_EVENT:
case ASM_STREAM_CMD_ENCDEC_EVENTS: