duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel into android13-4.19-kona

Browse Source 
"LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0"

* tag 'LA.UM.9.15.2.r1-09400-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
  Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));

Change-Id: I8869b37a4cc5223d37ec0169efb6eb2965916dd6
This commit is contained in:
Michael Bestas committed 2024-02-10 19:51:37 +02:00
2 parents cc0094191a 724bbe814d
commit 7883946a13
1 file changed
+6 -1
Download Patch File Download Diff File Expand all files Collapse all files
techpack/audio/asoc/msm-lsm-client.c
+6 -1
View File
@@ -2167,8 +2167,13 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
prtd->lsm_client->get_param_payload = NULL;
goto done;
}
if (__builtin_uadd_overflow(sizeof(p_info_32), p_info_32.param_size, &size)) {
pr_err("%s: param size exceeds limit of %u bytes.\n",
__func__, UINT_MAX);
err = -EINVAL;
goto done;
}
size = sizeof(p_info_32) + p_info_32.param_size;
param_info_rsp = kzalloc(size, GFP_KERNEL);
if (!param_info_rsp) {