Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d80d80d6 authored by suchawla's avatar suchawla
Browse files

msm: cvp: Add security check on packet 



Add check on offset and buf_num to avoid potential security issue.

Change-Id: Ieb6ac53132e65008e61b7dfd4b756aaadd63fb26
Signed-off-by: default avatarsuchawla <suchawla@codeaurora.org>
parent 4e1c68c5

drivers/media/platform/msm/cvp/msm_cvp.c

+11 −0
Original line number Diff line number Diff line
@@ -1329,6 +1329,7 @@ static int msm_cvp_session_process_hfi_fence( 
	struct cvp_kmd_hfi_packet *in_pkt;

	unsigned int signal, offset, buf_num, in_offset, in_buf_num;

	struct msm_cvp_inst *s;

	unsigned int max_buf_num;

	struct msm_cvp_fence_thread_data *fence_thread_data;



	dprintk(CVP_DBG, "%s: Enter inst = %#x", __func__, inst);
@@ -1374,6 +1375,16 @@ static int msm_cvp_session_process_hfi_fence( 
		buf_num = in_buf_num;

	}



	max_buf_num = sizeof(struct cvp_kmd_hfi_packet)

						/ sizeof(struct cvp_buf_type);



	if (buf_num > max_buf_num)

		return -EINVAL;



	if ((offset + buf_num * sizeof(struct cvp_buf_type)) >

					sizeof(struct cvp_kmd_hfi_packet))

		return -EINVAL;



	rc = msm_cvp_map_buf(inst, in_pkt, offset, buf_num);

	if (rc)

		goto free_and_exit;