Merge "msm: camera: util: validate patch offset value" into dev/msm-4.9-camx (81bf0ad3) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c

+19 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -171,6 +171,24 @@ int cam_packet_util_process_patches(struct cam_packet *packet,
		patch_desc[i].dst_buf_hdl, patch_desc[i].dst_offset,
		patch_desc[i].src_buf_hdl, patch_desc[i].src_offset);

		if (patch_desc[i].src_offset >= src_buf_size) {
		CAM_ERR_RATE_LIMIT(CAM_UTIL,
		"Inval src offset:0x%x src len:0x%x reqid:%lld",
		patch_desc[i].src_offset,
		(unsigned int)src_buf_size,
		packet->header.request_id);
		return -EINVAL;
		}

		if (patch_desc[i].dst_offset >= dst_buf_len) {
		CAM_ERR_RATE_LIMIT(CAM_UTIL,
		"Inval dst offset:0x%x dst len:0x%x reqid:%lld",
		patch_desc[i].dst_offset,
		(unsigned int)dst_buf_len,
		packet->header.request_id);
		return -EINVAL;
		}

		dst_cpu_addr = (uint32_t )((uint8_t )dst_cpu_addr +
		patch_desc[i].dst_offset);
		temp += patch_desc[i].src_offset;