From b6d6e5af1450ed5ccae042ab1125a6b799433b73 Mon Sep 17 00:00:00 2001 From: Ravindra Lokhande Date: Mon, 8 May 2017 14:42:48 +0530 Subject: ASoC: tegra: check ucode upper limit Check ucode size for upper limit. Bug 1901435 Bug 1954563 Bug 1917589 Signed-off-by: Ravindra Lokhande Signed-off-by: Xia Yang Change-Id: I2f455771147bb4466d154878d2461e472647c4fb Reviewed-on: https://git-master.nvidia.com/r/1575925 Reviewed-on: https://git-master.nvidia.com/r/1674399 GVS: Gerrit_Virtual_Submit Tested-by: Amulya Yarlagadda Tested-by: James Huang Reviewed-by: James Huang Reviewed-by: Winnie Hsu --- sound/soc/tegra/tegra30_avp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'sound') diff --git a/sound/soc/tegra/tegra30_avp.c b/sound/soc/tegra/tegra30_avp.c index 44d954561f96..a074e25614d1 100644 --- a/sound/soc/tegra/tegra30_avp.c +++ b/sound/soc/tegra/tegra30_avp.c @@ -256,7 +256,7 @@ static int tegra30_avp_load_ucode(void) struct audio_engine_data *audio_engine; const struct firmware *ucode_fw; const struct tegra30_avp_ucode_desc *ucode_desc; - int ucode_size = 0, ucode_offset = 0, total_ucode_size = 0; + ssize_t ucode_size = 0, ucode_offset = 0, total_ucode_size = 0; int i, ret = 0; dev_vdbg(audio_avp->dev, "%s", __func__); @@ -296,13 +296,14 @@ static int tegra30_avp_load_ucode(void) } ucode_size = ucode_fw->size; - if (ucode_size <= 0) { + if (ucode_size <= 0 || + ucode_size > avp_ucode_desc[i].max_mem_size) { dev_err(audio_avp->dev, "Invalid ucode size."); ret = -EINVAL; release_firmware(ucode_fw); goto err_param_mem_free; } - dev_vdbg(audio_avp->dev, "%s ucode size = %d bytes", + dev_vdbg(audio_avp->dev, "%s ucode size = %zd bytes", ucode_desc->bin_name, ucode_size); /* Read ucode */ -- cgit v1.2.3