nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 17:25:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

tegra-alt: adsp: add parameter size checks

Browse Source 
Fix possible buffer overflow in case of invalid user
parameter by adding size checks

Bug 1869543

Change-Id: I82ac00e24a3ca40915eb6c556454c9649cb644bd
Signed-off-by: Viraj Karandikar <vkarandikar@nvidia.com>
Reviewed-on: http://git-master/r/1297227
Reviewed-by: svccoveritychecker <svccoveritychecker@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Dipesh Gandhi <dipeshg@nvidia.com>
Reviewed-by: Ravindra Lokhande <rlokhande@nvidia.com>
This commit is contained in:
Viraj Karandikar
2017-02-01 16:21:19 +05:30
committed by Sameer Pujar
parent f56b54a18c
commit 5fe501ba84
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
sound/soc/tegra-alt/tegra210_adsp_alt.c
View File

@@ -3312,6 +3312,14 @@ static int tegra210_adsp_set_param(struct snd_kcontrol *kcontrol,
dev_warn(adsp->dev, "No params to pass to the plugin\n"); dev_warn(adsp->dev, "No params to pass to the plugin\n");
return 0; return 0;
} }
if (num_params + 2 >
sizeof(apm_msg.msg.fx_set_param_params.params)/
sizeof(apm_msg.msg.fx_set_param_params.params[0])) {
dev_err(adsp->dev, "parameter too large\n");
return -EINVAL;
}
apm_msg.msg.fx_set_param_params.params[0] = apm_msg.msg.fx_set_param_params.params[0] =
(sizeof(nvfx_call_params_t) + (sizeof(nvfx_call_params_t) +
num_params * sizeof(int32_t)); num_params * sizeof(int32_t));
@@ -3332,6 +3340,12 @@ static int tegra210_adsp_set_param(struct snd_kcontrol *kcontrol,
nvfx_call_params_t *call_params = nvfx_call_params_t *call_params =
(nvfx_call_params_t *)ucontrol->value.bytes.data; (nvfx_call_params_t *)ucontrol->value.bytes.data;
if (call_params->size >
sizeof(apm_msg.msg.fx_set_param_params.params)) {
dev_err(adsp->dev, "parameter too large\n");
return -EINVAL;
}
/* copy parameters */ /* copy parameters */
memcpy(&apm_msg.msg.fx_set_param_params.params, memcpy(&apm_msg.msg.fx_set_param_params.params,
call_params, call_params->size); call_params, call_params->size);