Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74e33ba3 authored by Shubhraprakash Das's avatar Shubhraprakash Das Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: isp: Check userspace parameters 



Check the user parameters passed to prevent buffer overflow.

Change-Id: Ia8adc88d993db9e4314f3aa85ff5bbb6d7cef31e
CRs-Fixed: 1097390
Signed-off-by: default avatarShubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: default avatarMeera Gande <mgande@codeaurora.org>
parent b81d100b

drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c

+11 −1
Original line number Diff line number Diff line
@@ -150,7 +150,7 @@ static void msm_ispif_get_pack_mask_from_cfg( 
			pack_mask[0] |= temp;

		CDBG("%s:num %d cid %d mode %d pack_mask %x %x\n",

			__func__, entry->num_cids, entry->cids[i],

			pack_cfg[i].pack_mode,

			pack_cfg[entry->cids[i]].pack_mode,

			pack_mask[0], pack_mask[1]);



	}
@@ -182,6 +182,16 @@ static int msm_ispif_config2(struct ispif_device *ispif, 
		return rc;

	}



	for (i = 0; i < params->num; i++) {

		int j;



		if (params->entries[i].num_cids > MAX_CID_CH_v2)

			return -EINVAL;

		for (j = 0; j < params->entries[i].num_cids; j++)

			if (params->entries[i].cids[j] >= CID_MAX)

				return -EINVAL;

	}



	for (i = 0; i < params->num; i++) {

		intftype = params->entries[i].intftype;

		vfe_intf = params->entries[i].vfe_intf;