Merge "ASoC: codecs: fix out of bounds copy" into msm-4.9
diff --git a/sound/soc/codecs/msm_hdmi_codec_rx.c b/sound/soc/codecs/msm_hdmi_codec_rx.c
index cd5e707..abc100f 100644
--- a/sound/soc/codecs/msm_hdmi_codec_rx.c
+++ b/sound/soc/codecs/msm_hdmi_codec_rx.c
@@ -84,6 +84,15 @@
rc = codec_data->ext_disp_ops.get_audio_edid_blk(
codec_data->ext_disp_core_pdev, &edid_blk);
if (rc >= 0) {
+ if (sizeof(ucontrol->value.bytes.data) <
+ (edid_blk.audio_data_blk_size +
+ edid_blk.spk_alloc_data_blk_size)) {
+ dev_err(codec->dev,
+ "%s: Not enough memory to copy EDID data\n",
+ __func__);
+ return -ENOMEM;
+ }
+
memcpy(ucontrol->value.bytes.data,
edid_blk.audio_data_blk,
edid_blk.audio_data_blk_size);