Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de2bd379 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: Proper use of snprintf to avoid information leak"

parents e7b3dad5 bf0c42e4
Loading
Loading
Loading
Loading
+27 −8
Original line number Diff line number Diff line
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -903,26 +903,45 @@ int msm_jpeg_hw_exec_cmds(struct msm_jpeg_hw_cmd *hw_cmd_p, uint32_t m_cmds,

void msm_jpeg_io_dump(void *base, int size)
{
	char line_str[128], *p_str;
	char line_str[128];
	void __iomem *addr = (void __iomem *)base;
	int i;
	u32 *p = (u32 *) addr;
	size_t offset = 0;
	size_t used = 0;
	size_t min_range = 0;
	size_t sizeof_line_str = sizeof(line_str);
	u32 data;
	JPEG_DBG_HIGH("%s:%d] %pK %d", __func__, __LINE__, addr, size);
	line_str[0] = '\0';
	p_str = line_str;
	for (i = 0; i < size/4; i++) {
		if (i % 4 == 0) {
			snprintf(p_str, 12, "%08lx: ", (unsigned long)p);
			p_str += 10;
			used = snprintf(line_str + offset,
				sizeof_line_str - offset, "%pK ", p);
			if ((used < min_range) ||
				(offset + used >= sizeof_line_str)) {
				JPEG_PR_ERR("%s\n", line_str);
				offset = 0;
				line_str[0] = '\0';
			} else {
				offset += used;
			}
		}
		data = msm_camera_io_r(p++);
		snprintf(p_str, 12, "%08x ", data);
		p_str += 9;
		used = snprintf(line_str + offset,
			sizeof_line_str - offset, "%08x ", data);
		if ((used < min_range) ||
			(offset + used >= sizeof_line_str)) {
			JPEG_PR_ERR("%s\n", line_str);
			offset = 0;
			line_str[0] = '\0';
		} else {
			offset += used;
		}
		if ((i + 1) % 4 == 0) {
			JPEG_DBG_HIGH("%s\n", line_str);
			line_str[0] = '\0';
			p_str = line_str;
			offset = 0;
		}
	}
	if (line_str[0] != '\0')