ASoC: wcd9320: Fix out of bounds for mad input value

Add check in taiko_mad_input_put function to return error on out of bounds access using mad input value CRs-fixed: 1096799 CAF-Change-Id: I75ce9e881cf05a50e874a555b2f8bd3286cdaed4 Signed-off-by: Karthikeyan Mani <[email protected]> CVE-2016-5858 [haggertk]: Backport to 3.4/msm8974 Change-Id: Ie28d6c34fd978098f45012f9d2f4b686100ce24b Signed-off-by: Francisco Franco <[email protected]>
franciscofranco · Sep 16, 2017 · ce05994 · ce05994
1 parent cf272ee
commit ce05994
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/sound/soc/codecs/wcd9320.c b/sound/soc/codecs/wcd9320.c
@@ -1244,6 +1244,13 @@ static int taiko_mad_input_put(struct snd_kcontrol *kcontrol,
 
 	taiko_mad_input = ucontrol->value.integer.value[0];
 
+	if (taiko_mad_input >= ARRAY_SIZE(taiko_conn_mad_text)) {
+		dev_err(codec->dev,
+			"%s: taiko_mad_input = %d out of bounds\n",
+			__func__, taiko_mad_input);
+		return -EINVAL;
+	}
+
 	pr_debug("%s: taiko_mad_input = %s\n", __func__,
 			taiko_conn_mad_text[taiko_mad_input]);