Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f27f7cca authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: cvp: Add security check on packet"

parents 7e88ad6b d80d80d6

drivers/media/platform/msm/cvp/msm_cvp.c

+11 −0
Original line number Diff line number Diff line
@@ -1329,6 +1329,7 @@ static int msm_cvp_session_process_hfi_fence( 
	struct cvp_kmd_hfi_packet *in_pkt;

	unsigned int signal, offset, buf_num, in_offset, in_buf_num;

	struct msm_cvp_inst *s;

	unsigned int max_buf_num;

	struct msm_cvp_fence_thread_data *fence_thread_data;



	dprintk(CVP_DBG, "%s: Enter inst = %#x", __func__, inst);
@@ -1374,6 +1375,16 @@ static int msm_cvp_session_process_hfi_fence( 
		buf_num = in_buf_num;

	}



	max_buf_num = sizeof(struct cvp_kmd_hfi_packet)

						/ sizeof(struct cvp_buf_type);



	if (buf_num > max_buf_num)

		return -EINVAL;



	if ((offset + buf_num * sizeof(struct cvp_buf_type)) >

					sizeof(struct cvp_kmd_hfi_packet))

		return -EINVAL;



	rc = msm_cvp_map_buf(inst, in_pkt, offset, buf_num);

	if (rc)

		goto free_and_exit;