commit 6176958fd382cac2b5adfff022c79186d1c0fbcb
author Soumya Managoli <smanag@codeaurora.org> Fri Sep 06 12:35:58 2019 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Mon Sep 16 02:36:39 2019 -0700
tree 7a71c63dc32a4aae711ce49d4f46854a0c7c9473
parent ff4075e5aff1ad31988d5965ff17d8bb519b6b2e

dsp: adm: Fix to avoid memory overread in adm callback

For ADM_CMDRSP_GET_PP_PARAMS_V5 cmd response,
the check for data payload_size is incorrect.
Modify the check condition to make sure there
is enough data to copy, size is contained in
payload[3].

Change-Id: I2f155ad8b302e89131ee85cfc72e4009dda617d3
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>

dsp/q6adm.c

diff --git a/dsp/q6adm.c b/dsp/q6adm.c
index 8d8a473..736d2be 100644
--- a/dsp/q6adm.c
+++ b/dsp/q6adm.c
@@ -1762,7 +1762,8 @@
 			idx = ADM_GET_PARAMETER_LENGTH * copp_idx;
 			if ((payload[0] == 0) && (data->payload_size >
 				(4 * sizeof(*payload))) &&
-				(data->payload_size - 4 >=
+				(data->payload_size -
+				(4 * sizeof(*payload)) >=
 				payload[3]) &&
 				(ARRAY_SIZE(adm_get_parameters) >
 				idx) &&