commit 199832370ccdcd6094621766648a2262f6c42a2d
author Linux Build Service Account <lnxbuild@localhost> Thu Sep 19 02:49:21 2019 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Thu Sep 19 02:49:21 2019 -0700
tree 00a0e1f3ecf48a7ff967d41c4a4b466d3e1641f2
parent 6176958fd382cac2b5adfff022c79186d1c0fbcb
parent 6356fbbc1c2aa6bac2082a1f9e0ebe9efee4baff

Merge "dsp: avtimer: validate payload size before memory copy" into audio-drivers.lnx.2.0.c7

dsp/avtimer.c

diff --git a/dsp/avtimer.c b/dsp/avtimer.c
index db9eb9a..ac3b19d 100644
--- a/dsp/avtimer.c
+++ b/dsp/avtimer.c
@@ -97,6 +97,13 @@
 		}
 
 		payload1 = data->payload;
+
+		if (data->payload_size < 2 * sizeof(uint32_t)) {
+			pr_err("%s: payload has invalid size %d\n",
+				__func__, data->payload_size);
+			return -EINVAL;
+		}
+
 		switch (payload1[0]) {
 		case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
 			pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
@@ -122,6 +129,11 @@
 	}
 
 	case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
+		if (data->payload_size < sizeof(uint32_t)) {
+			pr_err("%s: payload has invalid size %d\n",
+				__func__, data->payload_size);
+			return -EINVAL;
+		}
 		payload1 = data->payload;
 		pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
 			__func__, payload1[0]);