commit | 93fc68f1dceb8f77a6b9427f164f83e17ec8ddd3 | [log] [tgz] |
---|---|---|
author | Linux Build Service Account <lnxbuild@localhost> | Sun Sep 22 20:45:26 2019 -0700 |
committer | Gerrit - the friendly Code Review server <code-review@localhost> | Sun Sep 22 20:45:26 2019 -0700 |
tree | 00a0e1f3ecf48a7ff967d41c4a4b466d3e1641f2 | |
parent | 11c6858850a7d70d8258fb47aea5d95c34e44fa4 [diff] | |
parent | 73468d9d8a9c92afb4dc3a31e66d3750511b6cc4 [diff] |
Merge "dsp: avtimer: validate payload size before memory copy" into audio-drivers.lnx.2.0.r13-rel
diff --git a/dsp/q6adm.c b/dsp/q6adm.c index 8d8a473..736d2be 100644 --- a/dsp/q6adm.c +++ b/dsp/q6adm.c
@@ -1762,7 +1762,8 @@ idx = ADM_GET_PARAMETER_LENGTH * copp_idx; if ((payload[0] == 0) && (data->payload_size > (4 * sizeof(*payload))) && - (data->payload_size - 4 >= + (data->payload_size - + (4 * sizeof(*payload)) >= payload[3]) && (ARRAY_SIZE(adm_get_parameters) > idx) &&