Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f50e5dc8 authored by Govindaraj Rajagopal's avatar Govindaraj Rajagopal
Browse files

msm: vidc: avoid OOB write while accessing memory 



Exclude 4 bytes which holds the size of the buffer while calculating
the actual buffer size to avoid OOB write.

Change-Id: I965e78097a3680065aaf7609d35af1a42fc44824
Signed-off-by: default avatarGovindaraj Rajagopal <grajagop@codeaurora.org>
parent c6ad499d

msm/vidc/hfi_common.c

+9 −13
Original line number Diff line number Diff line
@@ -3069,20 +3069,19 @@ static int __power_collapse(struct venus_hfi_device *device, bool force) 
	return -EAGAIN;

}



static void __process_sys_error(struct venus_hfi_device *device)

static void print_sfr_message(struct venus_hfi_device *device)

{

	struct hfi_sfr_struct *vsfr = NULL;

	u32 vsfr_size = 0;

	void *p = NULL;



	vsfr = (struct hfi_sfr_struct *)device->sfr.align_virtual_addr;

	if (vsfr) {

		void *p = memchr(vsfr->rg_data, '\0', vsfr->bufSize);

		/*

		 * SFR isn't guaranteed to be NULL terminated

		 * since SYS_ERROR indicates that Venus is in the

		 * process of crashing.

		 */

		vsfr_size = vsfr->bufSize - sizeof(u32);

		p = memchr(vsfr->rg_data, '\0', vsfr_size);

		/* SFR isn't guaranteed to be NULL terminated */

		if (p == NULL)

			vsfr->rg_data[vsfr->bufSize - 1] = '\0';

			vsfr->rg_data[vsfr_size - 1] = '\0';



		d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data);

	}
@@ -3233,8 +3232,6 @@ static int __response_handler(struct venus_hfi_device *device) 
	}



	if (call_venus_op(device, watchdog, device->intr_status)) {

		struct hfi_sfr_struct *vsfr = (struct hfi_sfr_struct *)

			device->sfr.align_virtual_addr;

		struct msm_vidc_cb_info info = {

			.response_type = HAL_SYS_WATCHDOG_TIMEOUT,

			.response.cmd = {
@@ -3242,8 +3239,7 @@ static int __response_handler(struct venus_hfi_device *device) 
			}

		};



		if (vsfr)

			d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data);

		print_sfr_message(device);



		d_vpr_e("Received watchdog timeout\n");

		packets[packet_count++] = info;
@@ -3267,7 +3263,7 @@ static int __response_handler(struct venus_hfi_device *device) 
		/* Process the packet types that we're interested in */

		switch (info->response_type) {

		case HAL_SYS_ERROR:

			__process_sys_error(device);

			print_sfr_message(device);

			break;

		case HAL_SYS_RELEASE_RESOURCE_DONE:

			d_vpr_h("Received SYS_RELEASE_RESOURCE\n");