Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 359d1d30 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: cpp: Fixing Heap overflow in output buffer"

parents 96f71845 b5ac2b42

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+2 −0
Original line number Diff line number Diff line
@@ -2116,6 +2116,8 @@ static int msm_cpp_check_buf_type(struct msm_buf_mngr_info *buff_mgr_info, 
			/* More or equal bufs as Input buffer */

			num_output_bufs = new_frame->batch_info.batch_size;

		}

		if (num_output_bufs > MSM_OUTPUT_BUF_CNT)

			return 0;

		for (i = 0; i < num_output_bufs; i++) {

			new_frame->output_buffer_info[i].index =

				buff_mgr_info->user_buf.buf_idx[i];

include/uapi/media/msmb_pproc.h

+2 −1
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 
#define MSM_CPP_MAX_FRAME_LENGTH 4096

#define MSM_CPP_MAX_FW_NAME_LEN 32

#define MAX_FREQ_TBL 10

#define MSM_OUTPUT_BUF_CNT 8



enum msm_cpp_frame_type {

	MSM_CPP_OFFLINE_FRAME,
@@ -76,7 +77,7 @@ struct msm_cpp_frame_info_t { 
	uint32_t feature_mask;

	uint8_t we_disable;

	struct msm_cpp_buffer_info_t input_buffer_info;

	struct msm_cpp_buffer_info_t output_buffer_info[8];

	struct msm_cpp_buffer_info_t output_buffer_info[MSM_OUTPUT_BUF_CNT];

	struct msm_cpp_buffer_info_t duplicate_buffer_info;

	struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2];

	uint32_t reserved;