Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f769fe92 authored by Biswajit Paul's avatar Biswajit Paul Committed by TARKZiM
Browse files

msm: camera: Fix memory read by adding bounds check 

Adds bound check on reg_cfg_cmd->u.dmi_info.hi_tbl_offset.

IOCTL VIDIOC_MSM_VFE_REG_CFG uses usersupplied value without
performing bounds check for following cmd_type.
VFE_READ_DMI_16BIT
VFE_READ_DMI_32BIT
VFE_READ_DMI_64BIT

Bug: 28815326
CRs-Fixed: 1034641
Change-Id: Ic57c502edb7aed001b8d4656e28f117fe6b7311b
parent 61e5f653

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+4 −2
Original line number Diff line number Diff line
@@ -1104,13 +1104,15 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, 
		int i;

		uint32_t *hi_tbl_ptr = NULL, *lo_tbl_ptr = NULL;

		uint32_t hi_val, lo_val, lo_val1;

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT) {

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT ||

			reg_cfg_cmd->cmd_type == VFE_READ_DMI_64BIT) {

			hi_tbl_ptr = cfg_data +

				reg_cfg_cmd->u.dmi_info.hi_tbl_offset/4;

		}

		lo_tbl_ptr = cfg_data +

			reg_cfg_cmd->u.dmi_info.lo_tbl_offset/4;

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT)

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT ||

			reg_cfg_cmd->cmd_type == VFE_READ_DMI_64BIT)

			reg_cfg_cmd->u.dmi_info.len =

				reg_cfg_cmd->u.dmi_info.len / 2;

		for (i = 0; i < reg_cfg_cmd->u.dmi_info.len/4; i++) {