Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 528cc477 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: sensor: Validate eeprom_name string length"

parents 8811d36f 42e0f618

drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c

+18 −4
Original line number Diff line number Diff line
@@ -619,6 +619,7 @@ static int msm_eeprom_config(struct msm_eeprom_ctrl_t *e_ctrl, 
	struct msm_eeprom_cfg_data *cdata =

		(struct msm_eeprom_cfg_data *)argp;

	int rc = 0;

	size_t length = 0;



	CDBG("%s E\n", __func__);

	switch (cdata->cfgtype) {
@@ -631,9 +632,15 @@ static int msm_eeprom_config(struct msm_eeprom_ctrl_t *e_ctrl, 
		}

		CDBG("%s E CFG_EEPROM_GET_INFO\n", __func__);

		cdata->is_supported = e_ctrl->is_supported;

		length = strlen(e_ctrl->eboard_info->eeprom_name) + 1;

		if (length > MAX_EEPROM_NAME) {

			pr_err("%s:%d invalid eeprom_name length %d\n",

				__func__, __LINE__, (int)length);

			rc = -EINVAL;

			break;

		}

		memcpy(cdata->cfg.eeprom_name,

			e_ctrl->eboard_info->eeprom_name,

			sizeof(cdata->cfg.eeprom_name));

			e_ctrl->eboard_info->eeprom_name, length);

		break;

	case CFG_EEPROM_GET_CAL_DATA:

		CDBG("%s E CFG_EEPROM_GET_CAL_DATA\n", __func__);
@@ -1473,6 +1480,7 @@ static int msm_eeprom_config32(struct msm_eeprom_ctrl_t *e_ctrl, 
	struct msm_eeprom_cfg_data32 *cdata =

		(struct msm_eeprom_cfg_data32 *)argp;

	int rc = 0;

	size_t length = 0;



	CDBG("%s E\n", __func__);

	switch (cdata->cfgtype) {
@@ -1485,9 +1493,15 @@ static int msm_eeprom_config32(struct msm_eeprom_ctrl_t *e_ctrl, 
		}

		CDBG("%s E CFG_EEPROM_GET_INFO\n", __func__);

		cdata->is_supported = e_ctrl->is_supported;

		length = strlen(e_ctrl->eboard_info->eeprom_name) + 1;

		if (length > MAX_EEPROM_NAME) {

			pr_err("%s:%d invalid eeprom_name length %d\n",

				__func__, __LINE__, (int)length);

			rc = -EINVAL;

			break;

		}

		memcpy(cdata->cfg.eeprom_name,

			e_ctrl->eboard_info->eeprom_name,

			sizeof(cdata->cfg.eeprom_name));

			e_ctrl->eboard_info->eeprom_name, length);

		break;

	case CFG_EEPROM_GET_CAL_DATA:

		CDBG("%s E CFG_EEPROM_GET_CAL_DATA\n", __func__);

include/uapi/media/msm_cam_sensor.h

+1 −1
Original line number Diff line number Diff line
@@ -305,7 +305,7 @@ struct msm_eeprom_cfg_data { 
	enum eeprom_cfg_type_t cfgtype;

	uint8_t is_supported;

	union {

		char eeprom_name[MAX_SENSOR_NAME];

		char eeprom_name[MAX_EEPROM_NAME];

		struct eeprom_get_t get_data;

		struct eeprom_read_t read_data;

		struct eeprom_write_t write_data;