commit f98e05fdc6e7fc16c3d90925b7b5bac69ead34fb
author Linux Build Service Account <lnxbuild@localhost> Tue Nov 08 23:03:36 2022 -0800
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Nov 08 23:03:36 2022 -0800
tree d054616ef309a3d28cadc2057a3bf80238f2fe91
parent 7b99b9e54997bcd85d9ad10e080dea25b671fe93
parent 54e8263deae7ac69644fb2f89449fec6ee8ee9d5

Merge "agm: check for boundary size" into audio-platform-arintf.lnx.1.0.c10

service/src/graph.c

diff --git a/service/src/graph.c b/service/src/graph.c
index 41d8351..481baa2 100644
--- a/service/src/graph.c
+++ b/service/src/graph.c
@@ -1199,7 +1199,7 @@
     size_t size = 0;
     struct gsl_tag_module_info *tag_info;
     struct gsl_tag_module_info_entry *tag_entry;
-    uint32_t offset = 0;
+    uint32_t offset = 0, temp_sum = 0;
     uint32_t total_parsed_size = 0;
     uint8_t tag_pool[TAGGED_MOD_SIZE_BYTES] = { 0 };
 
@@ -1281,9 +1281,10 @@
         payloadACDBTunnelInfo->num_gkvs * sizeof(struct agm_key_value);
 
     AGM_LOGD("blob size = %d", payloadACDBTunnelInfo->blob_size);
-    actual_size = payloadACDBTunnelInfo->blob_size -
-        (payloadACDBTunnelInfo->num_gkvs + payloadACDBTunnelInfo->num_kvs) *
-                sizeof(struct agm_key_value);
+    __builtin_add_overflow(payloadACDBTunnelInfo->num_gkvs * sizeof(struct agm_key_value),
+            payloadACDBTunnelInfo->num_kvs * sizeof(struct agm_key_value),
+            &temp_sum);
+    __builtin_sub_overflow(payloadACDBTunnelInfo->blob_size, temp_sum, &actual_size);
     AGM_LOGD("actual size = 0x%x", actual_size);
     AGM_LOGI("num kvs = %d", kv.num_kvs);
     ptr = kv.kv;