Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07861097 authored by Rahul Sharma's avatar Rahul Sharma
Browse files

msm: ais: Bound check for num_of_stream 



- num of stream comes from userspace and used without
any bound check.It may result to overflow update_info.

Change-Id: I67341f3c3e1a3384474c35f6e6275d6e1917fdcd
CRs-Fixed: 2006829
Signed-off-by: default avatarRahul Sharma <sharah@codeaurora.org>
parent 1fd34cc0

drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c

+6 −0
Original line number Diff line number Diff line
@@ -890,6 +890,12 @@ int msm_isp_update_stats_stream(struct vfe_device *vfe_dev, void *arg) 
	struct msm_vfe_axi_stream_cfg_update_info *update_info = NULL;

	struct msm_isp_sw_framskip *sw_skip_info = NULL;



	if (update_cmd->num_streams > MSM_ISP_STATS_MAX) {

		pr_err("%s: Invalid num_streams %d\n",

			__func__, update_cmd->num_streams);

		return -EINVAL;

	}



	/* validate request */

	for (i = 0; i < update_cmd->num_streams; i++) {

		update_info = (struct msm_vfe_axi_stream_cfg_update_info *)