Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09c3b0c0 authored by Venu Yeshala's avatar Venu Yeshala Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: isp: Check bounds for ISP command parameters 



Validate the number of config and command length parameters
before programming to hardware.

Change-Id: Ie59bf9bb79c12be3b032fd66c97525b639080d8f
Signed-off-by: default avatarVenu Yeshala <vyeshala@codeaurora.org>
parent d2508db8

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+21 −15
Original line number Diff line number Diff line
@@ -1230,8 +1230,9 @@ int msm_isp_proc_cmd(struct vfe_device *vfe_dev, void *arg) 
	struct msm_vfe_reg_cfg_cmd *reg_cfg_cmd;

	uint32_t *cfg_data = NULL;



	if (!proc_cmd->num_cfg) {

		pr_err("%s: Passed num_cfg as 0\n", __func__);

	if (!proc_cmd->num_cfg ||

		proc_cmd->num_cfg > USHRT_MAX) {

		pr_err("%s: Invalid num_cfg %u\n", __func__, proc_cmd->num_cfg);

		return -EINVAL;

	}
@@ -1250,7 +1251,13 @@ int msm_isp_proc_cmd(struct vfe_device *vfe_dev, void *arg) 
		goto copy_cmd_failed;

	}



	if (proc_cmd->cmd_len > 0) {

	if (!proc_cmd->cmd_len ||

		proc_cmd->cmd_len > USHRT_MAX) {

		pr_err("%s: Invalid cmd_len %u\n", __func__, proc_cmd->cmd_len);

		rc = -EINVAL;

		goto cfg_data_failed;

	}



	cfg_data = kzalloc(proc_cmd->cmd_len, GFP_KERNEL);

	if (!cfg_data) {

		pr_err("%s: cfg_data alloc failed\n", __func__);
@@ -1264,7 +1271,6 @@ int msm_isp_proc_cmd(struct vfe_device *vfe_dev, void *arg) 
		rc = -EFAULT;

		goto copy_cmd_failed;

	}

	}



	for (i = 0; i < proc_cmd->num_cfg; i++)

		rc = msm_isp_send_hw_cmd(vfe_dev, &reg_cfg_cmd[i],