Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87443e59 authored by Rajesh Bondugula's avatar Rajesh Bondugula Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: flash: Validate the power setting size 



Validate the power setting size before copying.
If userspace sends a value which is greater than
MAX_POWER_CONFIG, then the driver accesses unintended memory.
This change will fix the issue.

CRs-Fixed: 1093232
Signed-off-by: default avatarRajesh Bondugula <rajeshb@codeaurora.org>
Change-Id: Ia49963248a94765baa19695294b197ea6f3bb8e2
parent 84267122

drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c

+10 −0
Original line number Diff line number Diff line
@@ -268,6 +268,16 @@ static int32_t msm_flash_i2c_init( 
	flash_ctrl->power_info.power_down_setting_size =

		flash_ctrl->power_setting_array.size_down;



	if ((flash_ctrl->power_info.power_setting_size > MAX_POWER_CONFIG) ||

	(flash_ctrl->power_info.power_down_setting_size > MAX_POWER_CONFIG)) {

		pr_err("%s:%d invalid power setting size=%d size_down=%d\n",

			__func__, __LINE__,

			flash_ctrl->power_info.power_setting_size,

			flash_ctrl->power_info.power_down_setting_size);

		rc = -EINVAL;

		goto msm_flash_i2c_init_fail;

	}



	rc = msm_camera_power_up(&flash_ctrl->power_info,

		flash_ctrl->flash_device_type,

		&flash_ctrl->flash_i2c_client);