Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 725b0b1c authored by E V Ravi's avatar E V Ravi Committed by Gerrit - the friendly Code Review server
Browse files

msm: ais: ife: Adds bound checking for output resources 



num_out_res which is part of acquire arguments from UMD
is not validated. Compute buffer size only if
num_out_res is less than MAX resources.

Change-Id: I5d6e263ec988f25a17bb6d587729472eb8d8deb9
Signed-off-by: default avatarE V Ravi <evenka@codeaurora.org>
parent 5b53fc04

drivers/media/platform/msm/ais/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

+9 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1616,6 +1616,14 @@ static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args) 


	/* acquire HW resources */

	for (i = 0; i < acquire_hw_info->num_inputs; i++) {



		if (in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) {

			CAM_ERR(CAM_ISP, "too many output res %d",

				in_port->num_out_res);

			rc = -EINVAL;

			goto free_res;

		}



		in_port_length = sizeof(struct cam_isp_in_port_info) +

			(in_port->num_out_res - 1) *

			sizeof(struct cam_isp_out_port_info);