| commit | 199832370ccdcd6094621766648a2262f6c42a2d | [log] [tgz] |
|---|---|---|
| author | Linux Build Service Account <lnxbuild@localhost> | Thu Sep 19 02:49:21 2019 -0700 |
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | Thu Sep 19 02:49:21 2019 -0700 |
| tree | 00a0e1f3ecf48a7ff967d41c4a4b466d3e1641f2 | |
| parent | 6176958fd382cac2b5adfff022c79186d1c0fbcb [diff] | |
| parent | 6356fbbc1c2aa6bac2082a1f9e0ebe9efee4baff [diff] |
Merge "dsp: avtimer: validate payload size before memory copy" into audio-drivers.lnx.2.0.c7
diff --git a/dsp/q6adm.c b/dsp/q6adm.c index 8d8a473..736d2be 100644 --- a/dsp/q6adm.c +++ b/dsp/q6adm.c
@@ -1762,7 +1762,8 @@ idx = ADM_GET_PARAMETER_LENGTH * copp_idx; if ((payload[0] == 0) && (data->payload_size > (4 * sizeof(*payload))) && - (data->payload_size - 4 >= + (data->payload_size - + (4 * sizeof(*payload)) >= payload[3]) && (ARRAY_SIZE(adm_get_parameters) > idx) &&