Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0a9ebf7 authored by Samyukta Mogily's avatar Samyukta Mogily Committed by Gerrit - the friendly Code Review server
Browse files

msm: sensor: Avoid potential stack overflow 



Add a check to validate the user input data is not
greater than expected stack buffer size to avoid out
of bounds array accesses

CRs-Fixed: 1056307
Change-Id: Ifd1f4e828373535fdf963aad22b217ae880c778c
Signed-off-by: default avatarSamyukta Mogily <smogily@codeaurora.org>
parent 7c8a2f0c

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c

+6 −0
Original line number Diff line number Diff line
@@ -276,6 +276,12 @@ int32_t msm_camera_cci_i2c_write_seq_table( 
	client_addr_type = client->addr_type;

	client->addr_type = write_setting->addr_type;



	if (reg_setting->reg_data_size > I2C_SEQ_REG_DATA_MAX) {

		pr_err("%s: number of bytes %u exceeding the max supported %d\n",

		__func__, reg_setting->reg_data_size, I2C_SEQ_REG_DATA_MAX);

		return rc;

	}



	for (i = 0; i < write_setting->size; i++) {

		rc = msm_camera_cci_i2c_write_seq(client, reg_setting->reg_addr,

			reg_setting->reg_data, reg_setting->reg_data_size);

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_qup_i2c.c

+6 −0
Original line number Diff line number Diff line
@@ -290,6 +290,12 @@ int32_t msm_camera_qup_i2c_write_seq_table(struct msm_camera_i2c_client *client, 
	client_addr_type = client->addr_type;

	client->addr_type = write_setting->addr_type;



	if (reg_setting->reg_data_size > I2C_SEQ_REG_DATA_MAX) {

		pr_err("%s: number of bytes %u exceeding the max supported %d\n",

		__func__, reg_setting->reg_data_size, I2C_SEQ_REG_DATA_MAX);

		return rc;

	}



	for (i = 0; i < write_setting->size; i++) {

		rc = msm_camera_qup_i2c_write_seq(client, reg_setting->reg_addr,

			reg_setting->reg_data, reg_setting->reg_data_size);