Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92fd4ddf authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: cvp:fix potential prop_array idx out range"

parents 81c099ae e7ba166e

drivers/media/platform/msm/cvp/msm_cvp.c

+6 −3
Original line number Diff line number Diff line
@@ -111,9 +111,12 @@ static int cvp_wait_process_message(struct msm_cvp_inst *inst, 
		goto exit;

	}



	if (out)

		memcpy(out, &msg->pkt, sizeof(struct cvp_hfi_msg_session_hdr));

	if (!out) {

		kmem_cache_free(cvp_driver->msg_cache, msg);

		goto exit;

	}



	memcpy(out, &msg->pkt, sizeof(struct cvp_hfi_msg_session_hdr));

	kmem_cache_free(cvp_driver->msg_cache, msg);

	hdr = (struct cvp_hfi_msg_session_hdr *)out;

	msm_cvp_unmap_frame(inst, hdr->client_data.kdata);
@@ -1122,7 +1125,7 @@ static int msm_cvp_set_sysprop(struct msm_cvp_inst *inst, 
		return -EINVAL;

	}



	if (props->prop_num >= MAX_KMD_PROP_NUM) {

	if (props->prop_num >= MAX_KMD_PROP_NUM_PER_PACKET) {

		dprintk(CVP_ERR, "Too many properties %d to set\n",

			props->prop_num);

		return -E2BIG;

include/uapi/media/msm_cvp_private.h

+2 −1
Original line number Diff line number Diff line
@@ -149,7 +149,8 @@ struct cvp_kmd_hfi_packet { 
#define CVP_KMD_PROP_PWR_DDR_OP	0x1C

#define CVP_KMD_PROP_PWR_SYSCACHE_OP	0x1D



#define MAX_KMD_PROP_NUM	(CVP_KMD_PROP_PWR_SYSCACHE_OP + 1)

#define MAX_KMD_PROP_NUM_PER_PACKET		8

#define MAX_KMD_PROP_TYPE	(CVP_KMD_PROP_PWR_SYSCACHE_OP + 1)



struct cvp_kmd_sys_property {

	__u32 prop_type;