Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92d90c3b authored by Lakshmi Narayana Kalavala's avatar Lakshmi Narayana Kalavala
Browse files

msm: camera: icp: Fix the buffer overflow 



Use the proper sanitized num_out_res variable to access
the out_res struct, otherwise can lead to buffer overflow.

Change-Id: I4438e76b706ca4176c873f82efb268dce799c3da
Signed-off-by: default avatarLakshmi Narayana Kalavala <lkalaval@codeaurora.org>
parent 7a55bd37

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+1 −1
Original line number Diff line number Diff line
@@ -1493,7 +1493,7 @@ static int cam_icp_get_acquire_info(struct cam_icp_hw_mgr *hw_mgr, 
		ctx_data->icp_dev_acquire_info->scratch_mem_size);



	p_icp_out = ctx_data->icp_dev_acquire_info->out_res;

	for (i = 0; i < ctx_data->icp_dev_acquire_info->num_out_res; i++)

	for (i = 0; i < icp_dev_acquire_info.num_out_res; i++)

		CAM_DBG(CAM_ICP, "out[i] %x %x %x %x",

			p_icp_out[i].format,

			p_icp_out[i].width,