Merge "msm: camera: eeprom: Fix OOB condition for memory map count" (fc7564bb) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c

+7 −6

Original line number	Diff line number	Diff line
		@@ -439,8 +439,9 @@ static int32_t cam_eeprom_parse_memory_map(
		else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)
		validate_size = sizeof(struct cam_cmd_unconditional_wait);

		if (remain_buf_len < validate_size \|\| *num_map >=
		(MSM_EEPROM_MEMORY_MAP_MAX_SIZE * MSM_EEPROM_MAX_MEM_MAP_CNT)) {
		if (remain_buf_len < validate_size \|\|
		num_map >= (MSM_EEPROM_MAX_MEM_MAP_CNT
		MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
		CAM_ERR(CAM_EEPROM, "not enough buffer");
		return -EINVAL;
		}
		@@ -449,10 +450,10 @@ static int32_t cam_eeprom_parse_memory_map(
		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;

		if (i2c_random_wr->header.count == 0 \|\|
		i2c_random_wr->header.count >=
		(MSM_EEPROM_MEMORY_MAP_MAX_SIZE *
		MSM_EEPROM_MAX_MEM_MAP_CNT) \|\|
		(size_t)*num_map > U16_MAX - i2c_random_wr->header.count) {
		i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT \|\|
		(size_t)num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT
		MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
		i2c_random_wr->header.count)) {
		CAM_ERR(CAM_EEPROM, "OOB Error");
		return -EINVAL;
		}