dsp: q6asm: check for buffer size before read
Check for debugfs ops buf size passed before reading
to avoid reading out of bounds.
Change-Id: Idd5e755ac16448af5751e2f3381097f234e74a74
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
diff --git a/dsp/q6asm.c b/dsp/q6asm.c
index a643823..9fb5d6b 100644
--- a/dsp/q6asm.c
+++ b/dsp/q6asm.c
@@ -284,6 +284,11 @@
pr_err("%s: out_buffer is null\n", __func__);
return 0;
}
+ if (count < OUT_BUFFER_SIZE) {
+ pr_err("%s: read size %d exceeds buf size %zd\n", __func__,
+ OUT_BUFFER_SIZE, count);
+ return 0;
+ }
snprintf(out_buffer, OUT_BUFFER_SIZE, "%ld,%ld,%ld,%ld,%ld,%ld,",
out_cold_tv.tv_sec, out_cold_tv.tv_usec, out_warm_tv.tv_sec,
out_warm_tv.tv_usec, out_cont_tv.tv_sec, out_cont_tv.tv_usec);
@@ -336,6 +341,11 @@
pr_err("%s: in_buffer is null\n", __func__);
return 0;
}
+ if (count < IN_BUFFER_SIZE) {
+ pr_err("%s: read size %d exceeds buf size %zd\n", __func__,
+ IN_BUFFER_SIZE, count);
+ return 0;
+ }
snprintf(in_buffer, IN_BUFFER_SIZE, "%ld,%ld,",
in_cont_tv.tv_sec, in_cont_tv.tv_usec);
return simple_read_from_buffer(buf, IN_BUFFER_SIZE, ppos,