commit 6c109767f869250f4e0c3e8ff35e2138b90f9aaf
author Linux Build Service Account <lnxbuild@localhost> Sun Sep 22 20:45:26 2019 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Sun Sep 22 20:45:27 2019 -0700
tree e8d06c2427422a94e561718982ca78b8a3d39937
parent 93fc68f1dceb8f77a6b9427f164f83e17ec8ddd3
parent 4c223ab1415a92fc3a0806d469f1b7db9b7cd090

Merge "dsp: adm: Add error check to avoid memory overread" into audio-drivers.lnx.2.0.r13-rel

dsp/q6adm.c

diff --git a/dsp/q6adm.c b/dsp/q6adm.c
index 736d2be..c313fdc 100644
--- a/dsp/q6adm.c
+++ b/dsp/q6adm.c
@@ -1804,9 +1804,12 @@
 				pr_err(":err = 0x%x\n", payload[0]);
 			} else if (data->payload_size >=
 				   (2 * sizeof(uint32_t))) {
-				if (payload[1] >
+				if ((payload[1] >
 				    ((ADM_GET_TOPO_MODULE_LIST_LENGTH /
-				    sizeof(uint32_t)) - 1)) {
+				    sizeof(uint32_t)) - 1)) ||
+				((data->payload_size -
+					(2 *  sizeof(uint32_t))) <
+					(payload[1] * sizeof(uint32_t)))) {
 					pr_err("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST",
 						 __func__);
 					pr_err(":size = %d\n", payload[1]);
@@ -1820,8 +1823,8 @@
 						adm_module_topo_list[idx+i] =
 							payload[1+i];
 						pr_debug("%s:payload[%d] = %x\n",
-							 __func__, (i+1),
-							 payload[1+i]);
+							__func__, (i+1),
+							payload[1+i]);
 					}
 				}
 			} else