[Sound-open-firmware] [PATCH 1/3] FIR equalizer: Fix a null pointer issue
The cd->config could be passed as null pointer to eq_fir_setup() if the previous malloc() would fail.
Signed-off-by: Seppo Ingalsuo seppo.ingalsuo@linux.intel.com --- src/audio/eq_fir.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/audio/eq_fir.c b/src/audio/eq_fir.c index 274393f..69e27fe 100644 --- a/src/audio/eq_fir.c +++ b/src/audio/eq_fir.c @@ -334,9 +334,10 @@ static int eq_fir_cmd(struct comp_dev *dev, int cmd, void *data) return -EINVAL;
cd->config = rmalloc(RZONE_RUNTIME, RFLAGS_NONE, bs); - if (cd->config != NULL) - memcpy(cd->config, blob->data, bs); + if (cd->config == NULL) + return -EINVAL;
+ memcpy(cd->config, blob->data, bs); eq_fir_setup(cd->fir, cd->config, source->params.pcm->channels); break; case COMP_CMD_MUTE:
The cd->config could be passed as null pointer to eq_iir_setup() if the previous malloc() would fail.
Signed-off-by: Seppo Ingalsuo seppo.ingalsuo@linux.intel.com --- src/audio/eq_iir.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/audio/eq_iir.c b/src/audio/eq_iir.c index a8def32..6c8ddc6 100644 --- a/src/audio/eq_iir.c +++ b/src/audio/eq_iir.c @@ -339,9 +339,10 @@ static int eq_iir_cmd(struct comp_dev *dev, int cmd, void *data)
/* Allocate and make a copy of the blob and setup IIR */ cd->config = rmalloc(RZONE_RUNTIME, RFLAGS_NONE, bs); - if (cd->config != NULL) - memcpy(cd->config, blob->data, bs); + if (cd->config == NULL) + return -EINVAL;
+ memcpy(cd->config, blob->data, bs); eq_iir_setup(cd->iir, cd->config, source->params.pcm->channels); break; case COMP_CMD_MUTE:
The s1.x_rptr, s1.y_wptr, and s2.y_wptr might be used as uninitialized. Also remove some obsolete code lines.
Signed-off-by: Seppo Ingalsuo seppo.ingalsuo@linux.intel.com --- src/audio/src.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-)
diff --git a/src/audio/src.c b/src/audio/src.c index 7a86a54..66cbbc1 100644 --- a/src/audio/src.c +++ b/src/audio/src.c @@ -168,6 +168,9 @@ static void src_2s_s32_default(struct comp_dev *dev, s2.y_size = sink->alloc_size; s2.y_inc = nch;
+ s1.x_rptr = src + nch - 1; + s2.y_wptr = dest + nch - 1; + for (j = 0; j < nch; j++) { s = &cd->src[j]; /* Point to src[] for this channel */ s1.x_rptr = src++; @@ -228,6 +231,8 @@ static void src_1s_s32_default(struct comp_dev *dev, s1.y_end_addr = sink->end_addr; s1.y_size = sink->alloc_size; s1.y_inc = nch; + s1.x_rptr = src + nch - 1; + s1.y_wptr = dest + nch - 1;
for (j = 0; j < nch; j++) { s = &cd->src[j]; /* Point to src for this channel */ @@ -268,18 +273,11 @@ static struct comp_dev *src_new(struct sof_ipc_comp *comp)
cd = rmalloc(RZONE_RUNTIME, RFLAGS_NONE, sizeof(*cd)); if (cd == NULL) { -#if SRC_SOF == 1 - rfree(dev); -#else rfree(dev); -#endif return NULL; }
comp_set_drvdata(dev, cd); -#if SRC_SOF == 0 - -#endif
cd->delay_lines = NULL; cd->src_func = src_2s_s32_default; @@ -295,21 +293,12 @@ static void src_free(struct comp_dev *dev)
trace_src("SFr");
-#if SRC_SOF == 1 - /* Free dynamically reserved buffers for SRC algorithm */ - if (cd->delay_lines != NULL) - rfree(cd->delay_lines); - - rfree(cd); - rfree(dev); -#else /* Free dynamically reserved buffers for SRC algorithm */ if (cd->delay_lines != NULL) rfree(cd->delay_lines);
rfree(cd); rfree(dev); -#endif }
/* set component audio stream parameters */
On Mon, 2017-06-12 at 11:31 +0300, Seppo Ingalsuo wrote:
The cd->config could be passed as null pointer to eq_fir_setup() if the previous malloc() would fail.
Signed-off-by: Seppo Ingalsuo seppo.ingalsuo@linux.intel.com
All applied.
Thanks
Liam
--------------------------------------------------------------------- Intel Corporation (UK) Limited Registered No. 1134945 (England) Registered Office: Pipers Way, Swindon SN3 1RJ VAT No: 860 2173 47
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.
participants (2)
-
Liam Girdwood -
Seppo Ingalsuo