Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82dc65e2 authored by Alok Kediya's avatar Alok Kediya Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Bound check for num_of_stream. 



- num of stream comes from userspace and used without
any bound check.It may result to overflow update_info.

CRs-Fixed: 2006829

Change-Id: I8226e8f7081b28108dbed738ea4579e2051a85f2
Signed-off-by: default avatarAlok Kediya <kediya@codeaurora.org>
parent b81d100b

drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c

+6 −0
Original line number Diff line number Diff line
@@ -882,6 +882,12 @@ int msm_isp_update_stats_stream(struct vfe_device *vfe_dev, void *arg) 
	struct msm_vfe_axi_stream_cfg_update_info *update_info = NULL;

	struct msm_isp_sw_framskip *sw_skip_info = NULL;



	if (update_cmd->num_streams > MSM_ISP_STATS_MAX) {

		pr_err("%s: Invalid num_streams %d\n",

			__func__, update_cmd->num_streams);

		return -EINVAL;

	}



	/*validate request*/

	for (i = 0; i < update_cmd->num_streams; i++) {

		update_info = (struct msm_vfe_axi_stream_cfg_update_info *)