Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09106cce authored by Sanjay Singh's avatar Sanjay Singh Committed by Gerrit - the friendly Code Review server
Browse files

msm_vidc: Add checks to avoid OOB access(refined) 



validate structures and payload sizes in the
packet against packet size to avoid OOB access.

Change-Id: I8a203a81506f603c2e37c1b2a780d3088e6933be
Signed-off-by: default avatarSanjay Singh <sisanj@codeaurora.org>
parent c33a1b4c

drivers/media/platform/msm/vidc/hfi_response_handler.c

+3 −0
Original line number Diff line number Diff line
@@ -1006,6 +1006,9 @@ static enum vidc_status hfi_parse_init_done_properties( 
			}

			while (prof_count) {

				prof_level = (struct hfi_profile_level *)ptr;

				VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -

					next_offset,

					sizeof(*prof_level));

				capability.

				profile_level.profile_level[count].profile

					= prof_level->profile;