Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5223e87 authored by Vikash Garodia's avatar Vikash Garodia Committed by Greg Kroah-Hartman
Browse files

media: venus: hfi: fix the check to handle session buffer requirement 



commit b18e36dfd6c935da60a971310374f3dfec3c82e1 upstream.

Buffer requirement, for different buffer type, comes from video firmware.
While copying these requirements, there is an OOB possibility when the
payload from firmware is more than expected size. Fix the check to avoid
the OOB possibility.

Cc: stable@vger.kernel.org
Fixes: 09c2845e ("[media] media: venus: hfi: add Host Firmware Interface (HFI)")
Reviewed-by: default avatarNathan Hebert <nhebert@chromium.org>
Signed-off-by: default avatarVikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: default avatarStanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4831e9f2

drivers/media/platform/qcom/venus/hfi_msgs.c

+1 −1
Original line number Diff line number Diff line
@@ -359,7 +359,7 @@ session_get_prop_buf_req(struct hfi_msg_session_property_info_pkt *pkt, 
		memcpy(&bufreq[idx], buf_req, sizeof(*bufreq));

		idx++;



		if (idx > HFI_BUFFER_TYPE_MAX)

		if (idx >= HFI_BUFFER_TYPE_MAX)

			return HFI_ERR_SESSION_INVALID_PARAMETER;



		req_bytes -= sizeof(struct hfi_buffer_requirements);