DivestOS/Patches/Linux_CVEs/CVE-2017-0632/ANY/0.patch

86 lines
3.7 KiB
Diff
Raw Normal View History

From 970d6933e53c1f7ca8c8b67f49147b18505c3b8f Mon Sep 17 00:00:00 2001
From: Aravind Kumar <akumark@codeaurora.org>
Date: Mon, 11 May 2015 18:19:11 +0530
Subject: ASoC: msm8x16-wcd: prevent out of bounds access
Hardcoding the third argument in strnstr function
is resulting in out of bounds access. Set the third argument
to sizeof the character string passed as the first argument
to prevent out of bounds access.
CRs-Fixed: 832915
Change-Id: I61be88701340e271fd866e0e1801722dbe7d63ac
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
---
sound/soc/codecs/msm8x16-wcd.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/sound/soc/codecs/msm8x16-wcd.c b/sound/soc/codecs/msm8x16-wcd.c
index 296f7d3..9a193c67 100644
--- a/sound/soc/codecs/msm8x16-wcd.c
+++ b/sound/soc/codecs/msm8x16-wcd.c
@@ -2603,19 +2603,19 @@ static int msm8x16_wcd_codec_enable_micbias(struct snd_soc_dapm_widget *w,
micbias2 = (snd_soc_read(codec, MSM8X16_WCD_A_ANALOG_MICB_2_EN) & 0x80);
switch (event) {
case SND_SOC_DAPM_PRE_PMU:
- if (strnstr(w->name, internal1_text, 30)) {
+ if (strnstr(w->name, internal1_text, strlen(w->name))) {
if (get_codec_version(msm8x16_wcd) == CAJON)
snd_soc_update_bits(codec,
MSM8X16_WCD_A_ANALOG_TX_1_2_ATEST_CTL_2,
0x02, 0x02);
snd_soc_update_bits(codec, micb_int_reg, 0x80, 0x80);
- } else if (strnstr(w->name, internal2_text, 30)) {
+ } else if (strnstr(w->name, internal2_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0x10, 0x10);
snd_soc_update_bits(codec, w->reg, 0x60, 0x00);
- } else if (strnstr(w->name, internal3_text, 30)) {
+ } else if (strnstr(w->name, internal3_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0x2, 0x2);
}
- if (!strnstr(w->name, external_text, 30))
+ if (!strnstr(w->name, external_text, strlen(w->name)))
snd_soc_update_bits(codec,
MSM8X16_WCD_A_ANALOG_MICB_1_EN, 0x05, 0x04);
if (w->reg == MSM8X16_WCD_A_ANALOG_MICB_1_EN)
@@ -2624,28 +2624,28 @@ static int msm8x16_wcd_codec_enable_micbias(struct snd_soc_dapm_widget *w,
break;
case SND_SOC_DAPM_POST_PMU:
usleep_range(20000, 20100);
- if (strnstr(w->name, internal1_text, 30)) {
+ if (strnstr(w->name, internal1_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0x40, 0x40);
- } else if (strnstr(w->name, internal2_text, 30)) {
+ } else if (strnstr(w->name, internal2_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0x08, 0x08);
msm8x16_notifier_call(codec,
WCD_EVENT_PRE_MICBIAS_2_ON);
- } else if (strnstr(w->name, internal3_text, 30)) {
+ } else if (strnstr(w->name, internal3_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0x01, 0x01);
- } else if (strnstr(w->name, external2_text, 30)) {
+ } else if (strnstr(w->name, external2_text, strlen(w->name))) {
msm8x16_notifier_call(codec,
WCD_EVENT_PRE_MICBIAS_2_ON);
}
break;
case SND_SOC_DAPM_POST_PMD:
- if (strnstr(w->name, internal1_text, 30)) {
+ if (strnstr(w->name, internal1_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0xC0, 0x40);
- } else if (strnstr(w->name, internal2_text, 30)) {
+ } else if (strnstr(w->name, internal2_text, strlen(w->name))) {
msm8x16_notifier_call(codec,
WCD_EVENT_PRE_MICBIAS_2_OFF);
- } else if (strnstr(w->name, internal3_text, 30)) {
+ } else if (strnstr(w->name, internal3_text, strlen(w->name))) {
snd_soc_update_bits(codec, micb_int_reg, 0x2, 0x0);
- } else if (strnstr(w->name, external2_text, 30)) {
+ } else if (strnstr(w->name, external2_text, strlen(w->name))) {
/*
* send micbias turn off event to mbhc driver and then
* break, as no need to set MICB_1_EN register.
--
cgit v1.1