Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 32d3795e authored by Mukund Madhusudan Atre's avatar Mukund Madhusudan Atre
Browse files

msm: camera: sensor: Subtract offset before validating cmd desc 



Subtract command descriptor offset from buffer length obtained
from kernel before validating length of command buffer.

Change-Id: I38b244873c20894ee26b687c4bb19ef103c79363
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
parent 5d21fab2

drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c

+2 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -338,6 +338,7 @@ int cam_sensor_i2c_command_parser( 
		cmd_buf = (uint32_t *)generic_ptr;

		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);



		remain_len -= cmd_desc[i].offset;

		if (remain_len < cmd_desc[i].length) {

			CAM_ERR(CAM_SENSOR, "buffer provided too small");

			return -EINVAL;