Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47f320fd authored by Trishansh Bhardwaj's avatar Trishansh Bhardwaj Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: ife: Adds bound checking for output resources 



Compute buffer size only if num_out_res is less than MAX resources.

Change-Id: I99740682ccc84cbd3aaa90afe1e42ab46160cc2c
Signed-off-by: default avatarTrishansh Bhardwaj <tbhardwa@codeaurora.org>
Signed-off-by: default avatarRaja Mallik <rmallik@codeaurora.org>
parent e4bc5ff2

drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

+8 −0
Original line number Diff line number Diff line
@@ -1572,6 +1572,14 @@ static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, 
			u64_to_user_ptr(isp_resource[i].res_hdl),

			isp_resource[i].length);

		if (!IS_ERR(in_port)) {

			if (in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) {

				CAM_ERR(CAM_ISP, "too many output res %d",

					in_port->num_out_res);

				rc = -EINVAL;

				kfree(in_port);

				goto free_res;

			}



			in_port_length = sizeof(struct cam_isp_in_port_info) +

				(in_port->num_out_res - 1) *

				sizeof(struct cam_isp_out_port_info);