dsp: q6adm: Resolve mem corruption in adm cb
Conversion of negative "num_modules" var value will result in max possible unsigned int value and hence can cause mem corruption when accessed. Resolve this by assigning the same data type to "num_modules" var as used in the calling fn. Mot-CRs-fixed: (CR) CVE-Fixed: CVE-2023-33034 CRs-Fixed: 3438425 Change-Id: I4c9d7215b9c7345637e1eb3a1992a41fef71c5cb Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com> Signed-off-by: Ashutosh Verma <ashverma@motorola.com> Reviewed-on: https://gerrit.mot.com/2673745 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Hujun Liao <liaohj@motorola.com> Submit-Approved: Jira Key
This commit is contained in:
1 parent
d3da11881a
commit
2a747d37bb
1 file changed
+2
-1
+2
-1
@@ -1,6 +1,7 @@
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
/*
|
||||
* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
|
||||
* Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
|
||||
*/
|
||||
#include <linux/module.h>
|
||||
#include <linux/slab.h>
|
||||
@@ -1550,7 +1551,7 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
|
||||
{
|
||||
uint32_t *payload;
|
||||
int port_idx, copp_idx, idx, client_id;
|
||||
int num_modules;
|
||||
uint32_t num_modules;
|
||||
int ret;
|
||||
|
||||
if (data == NULL) {
|
||||
|
||||
Reference in new issue
Block a user