commit f2384b9d3857f3db6d8120db6914d8b8b800a978
author Linux Build Service Account <lnxbuild@localhost> Sun Apr 07 23:34:59 2019 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Sun Apr 07 23:34:59 2019 -0700
tree 65d6d74785330495459c3220ab36684682d7fa39
parent 8abde874c5d7b8b3a29ee4d08cfec13d99b1f0fc
parent 46737029dc73d4f701e1bba43117ead589926152

Merge "dsp: q6usm: Check size of payload before access"

dsp/q6voice.c

diff --git a/dsp/q6voice.c b/dsp/q6voice.c
index e5b1139..742f18d 100644
--- a/dsp/q6voice.c
+++ b/dsp/q6voice.c
@@ -7839,6 +7839,11 @@
 
 		cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
 		if (cvs_voc_pkt != NULL &&  common.mvs_info.ul_cb != NULL) {
+			if (v->shmem_info.sh_buf.buf[1].size <
+			    ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
+				pr_err("%s: invalid voc pkt size\n", __func__);
+				return -EINVAL;
+			}
 			/* cvs_voc_pkt[0] contains tx timestamp */
 			common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],
 					      cvs_voc_pkt[2],