Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 345b6cd8 authored by Vishalsingh Hajeri's avatar Vishalsingh Hajeri
Browse files

msm: camera: ife: Adds bound checking for output resources 



num_out_res which is part of acquire arguments from UMD
is not validated. Compute buffer size only if
num_out_res is less than MAX resources.

Change-Id: I9e5c6f5630295f65d6201402efd9bca1b0fc96af
Signed-off-by: default avatarVishalsingh Hajeri <vhajeri@codeaurora.org>
parent b048651c

drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

+8 −0
Original line number Diff line number Diff line
@@ -1955,6 +1955,14 @@ static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args) 


	/* acquire HW resources */

	for (i = 0; i < acquire_hw_info->num_inputs; i++) {



		if (in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) {

			CAM_ERR(CAM_ISP, "too many output res %d",

				in_port->num_out_res);

			rc = -EINVAL;

			goto free_res;

		}



		in_port_length = sizeof(struct cam_isp_in_port_info) +

			(in_port->num_out_res - 1) *

			sizeof(struct cam_isp_out_port_info);