Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfe35953 authored by Govindaraj Rajagopal's avatar Govindaraj Rajagopal
Browse files

msm: vidc: update index from unsigned to signed number 



[1] if target ramsize value is higher than mentioned in
memory_limit_tbl_mbytes table, then index value will
reach zero in msm_comm_get_memory_limit.
[2] currently index is u32, so for nex iteration index value
will become huge positive value instead of -1.
[3] It will lead to OOB access at memory_limits_tbl[i].ddr_size.
and it will go in infinite loop.

Change-Id: I0bfcb98660af65a1e1852f9a67c2f26dcbdac232
Signed-off-by: default avatarGovindaraj Rajagopal <grajagop@codeaurora.org>
parent 4f9d7ba5

msm/vidc/msm_vidc_common.c

+2 −1
Original line number Diff line number Diff line
@@ -5743,8 +5743,9 @@ static u32 msm_comm_get_memory_limit(struct msm_vidc_core *core) 
{

	struct memory_limit_table *memory_limits_tbl;

	u32 memory_limits_tbl_size = 0;

	u32 i, memory_limit = 0, memory_size = 0;

	u32 memory_limit = 0, memory_size = 0;

	u32 memory_limit_mbytes = 0;

	int i = 0;



	memory_limits_tbl = core->resources.mem_limit_tbl;

	memory_limits_tbl_size = core->resources.memory_limit_table_size;