asoc: Add check to handle negative value passed for num_app_cfg_type
Long int negative value passed as part of ucontrol structure
is assigned to int num_app_cfg_type making it positive and
leading to overflow while populating maximum supported
lsm_app_type_cfg structures.
Change-Id: I81e3c75eea82265c8e8e1b3f8f95d9e334c895c4
Signed-off-by: Harshal Ahire <hahire@codeaurora.org>
diff --git a/asoc/msm-pcm-routing-v2.c b/asoc/msm-pcm-routing-v2.c
index 37635a8..7aafe2b 100644
--- a/asoc/msm-pcm-routing-v2.c
+++ b/asoc/msm-pcm-routing-v2.c
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-only
-/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
*/
#include <linux/init.h>
@@ -22773,9 +22773,9 @@
memset(app_type_cfg, 0, MAX_APP_TYPES*
sizeof(struct msm_pcm_routing_app_type_data));
- if (num_app_types > MAX_APP_TYPES) {
- pr_err("%s: number of app types exceed the max supported\n",
- __func__);
+ if (num_app_types > MAX_APP_TYPES || num_app_types < 0) {
+ pr_err("%s: number of app types %d is invalid\n",
+ __func__, num_app_types);
return -EINVAL;
}
for (j = 0; j < num_app_types; j++) {
@@ -22979,9 +22979,10 @@
int i = 0, j;
mutex_lock(&routing_lock);
- if (ucontrol->value.integer.value[0] > MAX_APP_TYPES) {
- pr_err("%s: number of app types exceed the max supported\n",
- __func__);
+ if (ucontrol->value.integer.value[0] < 0 ||
+ ucontrol->value.integer.value[0] > MAX_APP_TYPES) {
+ pr_err("%s: number of app types %ld is invalid\n",
+ __func__, ucontrol->value.integer.value[0]);
mutex_unlock(&routing_lock);
return -EINVAL;
}