commit f73dd9aa49a272391de235c238acd8b98392c22c
author Vatsal Bucha <vbucha@codeaurora.org> Tue Mar 05 15:52:15 2019 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Mon Apr 01 04:40:48 2019 -0700
tree 57140e9eedb8044095c20ca511f35a3a3afcadb1
parent 89a39443803d12385533d40c6b90d4a5abdf3fa6

dsp: q6voice: Check size of shared memory buffer before access

Check buffer size in qdsp_cvs_callback before access in
ul_pkt.

Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>

dsp/q6voice.c

diff --git a/dsp/q6voice.c b/dsp/q6voice.c
index e5b1139..742f18d 100644
--- a/dsp/q6voice.c
+++ b/dsp/q6voice.c
@@ -7839,6 +7839,11 @@
 
 		cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
 		if (cvs_voc_pkt != NULL &&  common.mvs_info.ul_cb != NULL) {
+			if (v->shmem_info.sh_buf.buf[1].size <
+			    ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
+				pr_err("%s: invalid voc pkt size\n", __func__);
+				return -EINVAL;
+			}
 			/* cvs_voc_pkt[0] contains tx timestamp */
 			common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],
 					      cvs_voc_pkt[2],