Merge "msm: cpp: Validate frame message before manipulating it" (19078ca4) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+24 −0

Original line number	Diff line number	Diff line
		@@ -1436,6 +1436,18 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev,
		}
		cpp_frame_msg = new_frame->cpp_cmd_msg;

		if (cpp_frame_msg == NULL \|\|
		(new_frame->msg_len < MSM_CPP_MIN_FRAME_LENGTH)) {
		pr_err("%s %d Length is not correct or frame message is missing\n",
		__func__, __LINE__);
		return -EINVAL;
		}

		if (cpp_frame_msg[new_frame->msg_len - 1] != MSM_CPP_MSG_ID_TRAILER) {
		pr_err("%s %d Invalid frame message\n", __func__, __LINE__);
		return -EINVAL;
		}

		in_phyaddr = msm_cpp_fetch_buffer_info(cpp_dev,
		&new_frame->input_buffer_info,
		((new_frame->input_buffer_info.identity >> 16) & 0xFFFF),
		@@ -1532,6 +1544,12 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev,
		goto phyaddr_err;
		}

		if ((stripe_base + num_stripes*27 + 1) != new_frame->msg_len) {
		pr_err("Invalid frame message\n");
		rc = -EINVAL;
		goto phyaddr_err;
		}

		for (i = 0; i < num_stripes; i++) {
		cpp_frame_msg[stripe_base + 5 + i*27] +=
		(uint32_t) in_phyaddr;
		@@ -1572,6 +1590,12 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev,

		stripe_base = STRIPE_BASE_FW_1_8_0;

		if ((stripe_base + num_stripes*48 + 1) != new_frame->msg_len) {
		pr_err("Invalid frame message\n");
		rc = -EINVAL;
		goto phyaddr_err;
		}

		for (i = 0; i < num_stripes; i++) {

		cpp_frame_msg[stripe_base + 8 + i * 48] +=

+2 −1

Original line number	Diff line number	Diff line
		@@ -16,7 +16,8 @@

		#define MAX_NUM_CPP_STRIPS 8
		#define MSM_CPP_MAX_NUM_PLANES 3
		#define MSM_CPP_MAX_FRAME_LENGTH 1024
		#define MSM_CPP_MIN_FRAME_LENGTH 13
		#define MSM_CPP_MAX_FRAME_LENGTH 2048
		#define MSM_CPP_MAX_FW_NAME_LEN 32
		#define MAX_FREQ_TBL 10