Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45dbb6c0 authored by Trishansh Bhardwaj's avatar Trishansh Bhardwaj
Browse files

msm: camera: ife: Add ife num outport bound checks 



Variable num_ports is provided by userspace, it it used to index
res_list_isp_out. Big num_ports value can cause out of bound read.

Bound check num_ports, to prevent OOB read.

CRs-Fixed: 3056360
Change-Id: I86b6cf0419c68af1f510ce166e4964e177367eaf
Signed-off-by: default avatarTrishansh Bhardwaj <tbhardwa@codeaurora.org>
parent 981b2405

drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c

+6 −8
Original line number Diff line number Diff line
@@ -124,6 +124,12 @@ static int cam_isp_update_dual_config( 
	cpu_addr += (cmd_desc->offset / 4);

	dual_config = (struct cam_isp_dual_config *)cpu_addr;



	if (dual_config->num_ports > size_isp_out) {

		CAM_ERR(CAM_ISP, "num_ports %d more than max_vfe_out_res %d",

			dual_config->num_ports, size_isp_out);

		return -EINVAL;

	}



	if ((dual_config->num_ports *

		sizeof(struct cam_isp_dual_stripe_config)) >

		(remain_len - offsetof(struct cam_isp_dual_config, stripes))) {
@@ -132,14 +138,6 @@ static int cam_isp_update_dual_config( 
	}

	for (i = 0; i < dual_config->num_ports; i++) {



		if (i >= CAM_ISP_IFE_OUT_RES_BASE + size_isp_out) {

			CAM_ERR(CAM_ISP,

				"failed update for i:%d > size_isp_out:%d",

				i, size_isp_out);

			rc = -EINVAL;

			goto end;

		}



		hw_mgr_res = &res_list_isp_out[i];

		if (!hw_mgr_res) {

			CAM_ERR(CAM_ISP,