Commit 0ca41fda authored May 23, 2017 by Senthil Kumar Rajagopal Committed by Gerrit - the friendly Code Review server Aug 29, 2017

msm: camera: isp: Add bound check for an array



The value of ab_ib_vote->num_src comes from userspace.
This value is used as an index for accessing the array
stream_src. Adding bound check to avoid accessing beyond array limit.

Change-Id: I1d4555234ced24af7cd70b71ca43981fe8a3f366
Signed-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>

parent ab5c5563

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -2444,6 +2444,12 @@ int msm_isp_ab_ib_update_lpm_mode(struct vfe_device vfe_dev, void arg)
		rc = -1;
		return rc;
		}
		if (ab_ib_vote->num_src >= VFE_AXI_SRC_MAX) {
		pr_err("%s: ab_ib_vote num_src is exceeding limit\n",
		__func__);
		rc = -1;
		return rc;
		}
		if (ab_ib_vote->lpm_mode) {
		for (i = 0; i < ab_ib_vote->num_src; i++) {
		stream_info =