ASoC: msm-pcm-voip: Avoid interger underflow.
There is no check for voip pkt pkt_len,if it contains the
min required data. This can lead to integer underflow.
Add check for the same.
Issue: FP3SEC-1134
Change-Id: I4f57eb125967d52ad8da60d21a440af1f81d2579
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
(cherry picked from commit 1c236fc34f7ac70bc9794245c19cb3deb240d215)
(cherry picked from commit 9fd4f45cbc464383fb4f99de09189a6b54211db7)
diff --git a/asoc/msm-pcm-voip-v2.c b/asoc/msm-pcm-voip-v2.c
index 02cee29..333d176 100644
--- a/asoc/msm-pcm-voip-v2.c
+++ b/asoc/msm-pcm-voip-v2.c
@@ -1,13 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 and
- * only version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/init.h>
@@ -371,6 +364,13 @@
switch (prtd->mode) {
case MODE_AMR_WB:
case MODE_AMR: {
+ if (pkt_len <= DSP_FRAME_HDR_LEN) {
+ pr_err("%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(&prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
/* Remove the DSP frame info header. Header format:
* Bits 0-3: Frame rate
* Bits 4-7: Frame type
@@ -391,6 +391,13 @@
case MODE_4GV_NB:
case MODE_4GV_WB:
case MODE_4GV_NW: {
+ if (pkt_len <= DSP_FRAME_HDR_LEN) {
+ pr_err("%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(&prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
/* Remove the DSP frame info header.
* Header format:
* Bits 0-3: frame rate
@@ -428,6 +435,13 @@
buf_node->frame.frm_hdr.timestamp = timestamp;
voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN;
+ if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) {
+ pr_err("%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(&prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
/* There are two frames in the buffer. Length of the
* first frame:
*/