Merge "dsp: q6voice: Check size of shared memory buffer before access"
diff --git a/dsp/q6voice.c b/dsp/q6voice.c
index e5b1139..742f18d 100644
--- a/dsp/q6voice.c
+++ b/dsp/q6voice.c
@@ -7839,6 +7839,11 @@
cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) {
+ if (v->shmem_info.sh_buf.buf[1].size <
+ ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
+ pr_err("%s: invalid voc pkt size\n", __func__);
+ return -EINVAL;
+ }
/* cvs_voc_pkt[0] contains tx timestamp */
common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],
cvs_voc_pkt[2],