Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea9f618c authored by Raja Mallik's avatar Raja Mallik Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera_v3: sensor: Subtract offset before validating cmd desc 



Subtract command descriptor offset from buffer length obtained
from kernel before validating length of command buffer.

Change-Id: I38b244873c20894ee26b687c4bb19ef103c79363
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
Signed-off-by: default avatarRaja Mallik <rmallik@codeaurora.org>
parent 9e33533f

drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c

+1 −0
Original line number Diff line number Diff line
@@ -338,6 +338,7 @@ int cam_sensor_i2c_command_parser( 
		cmd_buf = (uint32_t *)generic_ptr;

		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);



		remain_len -= cmd_desc[i].offset;

		if (remain_len < cmd_desc[i].length) {

			CAM_ERR(CAM_SENSOR, "buffer provided too small");

			return -EINVAL;