| From 65a58bae4ec3e773e39e5899c56f2987246de0b0 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 2 Feb 2021 17:21:05 +0100 |
| Subject: staging: most: sound: add sanity check for function argument |
| |
| From: Christian Gromm <christian.gromm@microchip.com> |
| |
| [ Upstream commit 45b754ae5b82949dca2b6e74fa680313cefdc813 ] |
| |
| This patch checks the function parameter 'bytes' before doing the |
| subtraction to prevent memory corruption. |
| |
| Signed-off-by: Christian Gromm <christian.gromm@microchip.com> |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Link: https://lore.kernel.org/r/1612282865-21846-1-git-send-email-christian.gromm@microchip.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/staging/most/sound/sound.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c |
| index 3a1a59058042..45befb8c1126 100644 |
| --- a/drivers/staging/most/sound/sound.c |
| +++ b/drivers/staging/most/sound/sound.c |
| @@ -86,6 +86,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes) |
| { |
| unsigned int i = 0; |
| |
| + if (bytes < 2) |
| + return; |
| while (i < bytes - 2) { |
| dest[i] = source[i + 2]; |
| dest[i + 1] = source[i + 1]; |
| -- |
| 2.30.1 |
| |
