diff options
| author | Kunlei Zhang <kunleiz@codeaurora.org> | 2021-05-11 14:56:29 +0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2021-07-06 04:27:53 -0700 |
| commit | 322dbdb9c35bf9652406f16962e10eb595905239 (patch) | |
| tree | 3ac39e2e42ab0348b68f3daaa8aa81104e5bad98 | |
| parent | 3840e289c3650efa91a824ffd300ce0a99e62b56 (diff) | |
| download | msm-extra-322dbdb9c35bf9652406f16962e10eb595905239.tar.gz | |
dsp: fix out of bound access for cal_data size
Add change to fix cal_data index out of bounds error.
Change-Id: I8c8e62835e496c0f35fdc09757f4206c52020727
Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>
| -rw-r--r-- | dsp/q6afe.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/dsp/q6afe.c b/dsp/q6afe.c index 5880ec93..c1e89ff8 100644 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -10187,8 +10187,7 @@ static int afe_get_cal_spv4_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL] == NULL || cal_data == NULL || - data_size > sizeof(*cal_data) || - data_size < sizeof(cal_data->cal_hdr)) + data_size != sizeof(*cal_data)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_V4_EX_VI_CAL]->lock); @@ -10255,8 +10254,7 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL || cal_data == NULL || - data_size > sizeof(*cal_data) || - data_size < sizeof(cal_data->cal_hdr)) + data_size != sizeof(*cal_data)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock); |