Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0e2ff95 authored by Mukund Madhusudan Atre's avatar Mukund Madhusudan Atre
Browse files

msm: camera: icp: Fixing OOB read in icp manager 



Adding check for command descriptor offset and length
against length obtained from kernel.

Change-Id: Ic9a4d0612870df5268a47fc59490b688f9939748
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
parent 5d21fab2

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+7 −0
Original line number Diff line number Diff line
@@ -3400,6 +3400,13 @@ static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr, 
					num_cmd_buf-- : 0;

				goto rel_cmd_buf;

			}

			if ((len <= cmd_desc[i].offset) ||

				(cmd_desc[i].size < cmd_desc[i].length) ||

				((len - cmd_desc[i].offset) <

				cmd_desc[i].length)) {

				CAM_ERR(CAM_ICP, "Invalid offset or length");

				goto rel_cmd_buf;

			}

			cpu_addr = cpu_addr + cmd_desc[i].offset;

		}

	}