Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7369a1d authored by Samyukta Mogily's avatar Samyukta Mogily Committed by Gerrit - the friendly Code Review server
Browse files

msm: sensor: Fix to validate the settings size in flash 



The size of the settings, copied from userspace, is directly checked
in msm_cci_data_queue with CCI_I2C_MAX_WRITE. This might cause
out of bound access in function msm_cci_data_queue as the max size is
MAX_I2C_REG_SET. Hence adding check on the size in flash driver itself.

Change-Id: Ifac358be9f4b4ff60d14c20e02886c2d044e7f52
Signed-off-by: default avatarSamyukta Mogily <smogily@codeaurora.org>
parent cea658fb

drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c

+6 −0
Original line number Diff line number Diff line
@@ -151,6 +151,12 @@ static int32_t msm_flash_i2c_write_table( 
	conf_array.reg_setting = settings->reg_setting_a;

	conf_array.size = settings->size;



	/* Validate the settings size */

	if ((!conf_array.size) || (conf_array.size > MAX_I2C_REG_SET)) {

		pr_err("failed: invalid size %d", conf_array.size);

		return -EINVAL;

	}



	return flash_ctrl->flash_i2c_client.i2c_func_tbl->i2c_write_table(

		&flash_ctrl->flash_i2c_client, &conf_array);

}