Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 350cd65c authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: utils: Fix OOB read due to wrong kmd cmd buffer index"

parents ffc4f010 5f958f66

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+7 −0
Original line number Diff line number Diff line
@@ -3435,6 +3435,13 @@ static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr, 
					num_cmd_buf--;

				goto rel_cmd_buf;

			}

			if ((len <= cmd_desc[i].offset) ||

				(cmd_desc[i].size < cmd_desc[i].length) ||

				((len - cmd_desc[i].offset) <

				cmd_desc[i].length)) {

				CAM_ERR(CAM_ICP, "Invalid offset or length");

				goto rel_cmd_buf;

			}

			cpu_addr = cpu_addr + cmd_desc[i].offset;

		}

	}

drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c

+1 −1
Original line number Diff line number Diff line
@@ -102,7 +102,7 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet, 
	}



	if ((packet->kmd_cmd_buf_index < 0) ||

		(packet->kmd_cmd_buf_index > packet->num_cmd_buf)) {

		(packet->kmd_cmd_buf_index >= packet->num_cmd_buf)) {

		CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",

			packet->kmd_cmd_buf_index);

		return -EINVAL;