Merge "msm: camera: isp: Check bounds for ISP command parameters" (36fd3474) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+21 −15

Original line number	Diff line number	Diff line
		@@ -1230,8 +1230,9 @@ int msm_isp_proc_cmd(struct vfe_device vfe_dev, void arg)
		struct msm_vfe_reg_cfg_cmd *reg_cfg_cmd;
		uint32_t *cfg_data = NULL;

		if (!proc_cmd->num_cfg) {
		pr_err("%s: Passed num_cfg as 0\n", __func__);
		if (!proc_cmd->num_cfg \|\|
		proc_cmd->num_cfg > USHRT_MAX) {
		pr_err("%s: Invalid num_cfg %u\n", __func__, proc_cmd->num_cfg);
		return -EINVAL;
		}

		@@ -1250,7 +1251,13 @@ int msm_isp_proc_cmd(struct vfe_device vfe_dev, void arg)
		goto copy_cmd_failed;
		}

		if (proc_cmd->cmd_len > 0) {
		if (!proc_cmd->cmd_len \|\|
		proc_cmd->cmd_len > USHRT_MAX) {
		pr_err("%s: Invalid cmd_len %u\n", __func__, proc_cmd->cmd_len);
		rc = -EINVAL;
		goto cfg_data_failed;
		}

		cfg_data = kzalloc(proc_cmd->cmd_len, GFP_KERNEL);
		if (!cfg_data) {
		pr_err("%s: cfg_data alloc failed\n", __func__);
		@@ -1264,7 +1271,6 @@ int msm_isp_proc_cmd(struct vfe_device vfe_dev, void arg)
		rc = -EFAULT;
		goto copy_cmd_failed;
		}
		}

		for (i = 0; i < proc_cmd->num_cfg; i++)
		rc = msm_isp_send_hw_cmd(vfe_dev, &reg_cfg_cmd[i],