Merge "dsp: adm: Add error check to avoid memory overread" into audio-drivers.lnx.2.0.r13-rel
diff --git a/dsp/avtimer.c b/dsp/avtimer.c
index db9eb9a..ac3b19d 100644
--- a/dsp/avtimer.c
+++ b/dsp/avtimer.c
@@ -97,6 +97,13 @@
}
payload1 = data->payload;
+
+ if (data->payload_size < 2 * sizeof(uint32_t)) {
+ pr_err("%s: payload has invalid size %d\n",
+ __func__, data->payload_size);
+ return -EINVAL;
+ }
+
switch (payload1[0]) {
case AVCS_CMD_REMOTE_AVTIMER_RELEASE_REQUEST:
pr_debug("%s: Cmd = TIMER RELEASE status[0x%x]\n",
@@ -122,6 +129,11 @@
}
case AVCS_CMD_RSP_REMOTE_AVTIMER_VOTE_REQUEST:
+ if (data->payload_size < sizeof(uint32_t)) {
+ pr_err("%s: payload has invalid size %d\n",
+ __func__, data->payload_size);
+ return -EINVAL;
+ }
payload1 = data->payload;
pr_debug("%s: RSP_REMOTE_AVTIMER_VOTE_REQUEST handle %x\n",
__func__, payload1[0]);
diff --git a/dsp/q6adm.c b/dsp/q6adm.c
index 5987d39..c313fdc 100644
--- a/dsp/q6adm.c
+++ b/dsp/q6adm.c
@@ -1762,7 +1762,8 @@
idx = ADM_GET_PARAMETER_LENGTH * copp_idx;
if ((payload[0] == 0) && (data->payload_size >
(4 * sizeof(*payload))) &&
- (data->payload_size - 4 >=
+ (data->payload_size -
+ (4 * sizeof(*payload)) >=
payload[3]) &&
(ARRAY_SIZE(adm_get_parameters) >
idx) &&