rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

dsp: adm: Fix to avoid memory overread in adm callback

Browse Source 
For ADM_CMDRSP_GET_PP_PARAMS_V5 cmd response,
the check for data payload_size is incorrect.
Modify the check condition to make sure there
is enough data to copy, size is contained in
payload[3].

Change-Id: I2f155ad8b302e89131ee85cfc72e4009dda617d3
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
CVE-2019-14038
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
Soumya Managoli
2020-08-08 14:50:23 +02:00
committed by matteo0026
parent f5043e0d50
commit 76e0a16113
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sound/soc/msm/qdsp6v2/q6adm.c
+2 -1
View File
@@ -650,7 +650,8 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
/* is big enough and has a valid param size */
if ((payload[0] == 0) && (data->payload_size >
(4 * sizeof(*payload))) &&
(data->payload_size - 4 >=
(data->payload_size -
(4 * sizeof(*payload)) >=
payload[3]) &&
(ARRAY_SIZE(adm_get_parameters)-1 >=
payload[3])) {