[Sound-open-firmware] [PATCH] DMIC: Add robustness against erroneous configuration parameters

[Seppo Ingalsuo]

This patch ensures that modes matching request returns immediately if
the results length would exceed the allocated length. The caller function
will issue an error in such case.

Also the possibility of using array pdm[] in the IPM helper function
as uninitialized is avoided by initializing it with zeros.

Signed-off-by: Seppo Ingalsuo <seppo.ingalsuo at linux.intel.com>
---
 src/drivers/dmic.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/drivers/dmic.c b/src/drivers/dmic.c
index 33783f8..5c8591c 100644
--- a/src/drivers/dmic.c
+++ b/src/drivers/dmic.c
@@ -334,6 +334,11 @@ static void match_modes(struct matched_modes *c, struct decim_modes *a,
 		return;
 	}
 
+	/* Ensure that num_of_modes is sane. */
+	if (a->num_of_modes > DMIC_MAX_MODES ||
+		b->num_of_modes > DMIC_MAX_MODES)
+		return;
+
 	/* Check for request only for FIFO A or B. In such case pass list for
 	 * A or B as such.
 	 */
@@ -633,7 +638,7 @@ static int select_mode(struct dmic_configuration *cfg,
 static inline void ipm_helper(int *ipm, int stereo[], int swap[],
 	struct sof_ipc_dai_dmic_params *dmic)
 {
-	int pdm[DMIC_HW_CONTROLLERS];
+	int pdm[DMIC_HW_CONTROLLERS] = {0};
 	int cnt;
 	int i;
 
-- 
2.14.1