Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0452baa3 authored by Sreesudhan Ramakrish Ramkumar's avatar Sreesudhan Ramakrish Ramkumar
Browse files

msm: camera: isp: Validate reg_offset and len parameters 



Validate reg_offset and len parameters before consuming to
avoid invalid register access.

Change-Id: I07676a6d10a9945fb0b99ebfd147075f896fbfab
Signed-off-by: default avatarSreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
parent dca34e2b

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+14 −0
Original line number Diff line number Diff line
@@ -902,6 +902,20 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, 
	}

	switch (reg_cfg_cmd->cmd_type) {

	case VFE_WRITE: {

		if (reg_cfg_cmd->u.rw_info.reg_offset <

			resource_size(vfe_dev->vfe_mem)) {

			uint32_t diff = 0;

			diff = resource_size(vfe_dev->vfe_mem) -

				reg_cfg_cmd->u.rw_info.reg_offset;

			if (diff < reg_cfg_cmd->u.rw_info.len) {

				pr_err("%s: VFE_WRITE: Invalid length\n",

					__func__);

				return -EINVAL;

			}

		} else {

			pr_err("%s: VFE_WRITE: Invalid length\n", __func__);

			return -EINVAL;

		}

		if (resource_size(vfe_dev->vfe_mem) <

			(reg_cfg_cmd->u.rw_info.reg_offset +

			reg_cfg_cmd->u.rw_info.len)) {