Commit 5e10f3e4 authored Oct 09, 2013 by Iliya Varadzhakov

msm:cpp: Validate data lenght in Set Clock command



The lenght of the data packet recived in case of
VIDIOC_MSM_CPP_SET_CLOCK command must be validated.
It have to be equal or smaller than the size of the
variable used to hold the data. If this condition
is not met stack-based buffer overflow will occur.

Change-Id: I68002e088aaca1ca740985d9e26e9161f130b499
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>

parent 01364e16

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1645,6 +1645,12 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
		return -EINVAL;
		}

		if (ioctl_ptr->len > sizeof(clock_rate)) {
		pr_err("Not valid ioctl_ptr->len\n");
		mutex_unlock(&cpp_dev->mutex);
		return -EINVAL;
		}

		rc = (copy_from_user(&clock_rate,
		(void __user *)ioctl_ptr->ioctl_ptr,
		ioctl_ptr->len) ? -EFAULT : 0);