Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d40320b6 authored by Pushkaraj Patil's avatar Pushkaraj Patil
Browse files

msm: vidc: Do sanity check for different IOCTL cmd 



Wrong buffer length or buffer type sent by V4L2 client
is not handled properly in V4L2 framework, which results
in page fault situation in different IOCTL functions
like prepare buf. Do a sanity check for the same.

Change-Id: I795076e8f7fc6d511eb728f44cd50015e704ffa1
Signed-off-by: default avatarPushkaraj Patil <ppatil@codeaurora.org>
parent 2e272c5b

drivers/media/platform/msm/vidc/msm_vidc.c

+15 −6
Original line number Diff line number Diff line
@@ -733,6 +733,13 @@ int msm_vidc_prepare_buf(void *instance, struct v4l2_buffer *b) 
	if (!inst || !b)

		return -EINVAL;



	if (!V4L2_TYPE_IS_MULTIPLANAR(b->type) || !b->length ||

		(b->length > VIDEO_MAX_PLANES)) {

		dprintk(VIDC_ERR, "%s: wrong input params\n",

				__func__);

		return -EINVAL;

	}



	if (is_dynamic_output_buffer_mode(b, inst)) {

		dprintk(VIDC_ERR, "%s: not supported in dynamic buffer mode\n",

				__func__);
@@ -885,9 +892,10 @@ int msm_vidc_qbuf(void *instance, struct v4l2_buffer *b) 
	if (!inst || !b)

		return -EINVAL;



	if (b->length > VIDEO_MAX_PLANES) {

		dprintk(VIDC_ERR, "num planes exceeds max: %d\n",

			b->length);

	if (!V4L2_TYPE_IS_MULTIPLANAR(b->type) || !b->length ||

		(b->length > VIDEO_MAX_PLANES)) {

		dprintk(VIDC_ERR, "%s: wrong input params\n",

				__func__);

		return -EINVAL;

	}
@@ -968,9 +976,10 @@ int msm_vidc_dqbuf(void *instance, struct v4l2_buffer *b) 
	if (!inst || !b)

		return -EINVAL;



	if (b->length > VIDEO_MAX_PLANES) {

		dprintk(VIDC_ERR, "num planes exceed maximum: %d\n",

			b->length);

	if (!V4L2_TYPE_IS_MULTIPLANAR(b->type) || !b->length ||

		(b->length > VIDEO_MAX_PLANES)) {

		dprintk(VIDC_ERR, "%s: wrong input params\n",

				__func__);

		return -EINVAL;

	}