dsp: q6voice: Check size of shared memory buffer before access
Check buffer size in qdsp_cvs_callback before access in
ul_pkt.
Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
diff --git a/dsp/q6voice.c b/dsp/q6voice.c
index e5b1139..742f18d 100644
--- a/dsp/q6voice.c
+++ b/dsp/q6voice.c
@@ -7839,6 +7839,11 @@
cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) {
+ if (v->shmem_info.sh_buf.buf[1].size <
+ ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
+ pr_err("%s: invalid voc pkt size\n", __func__);
+ return -EINVAL;
+ }
/* cvs_voc_pkt[0] contains tx timestamp */
common.mvs_info.ul_cb((uint8_t *)&cvs_voc_pkt[3],
cvs_voc_pkt[2],