Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 579d766c authored by Mukund Madhusudan Atre's avatar Mukund Madhusudan Atre
Browse files

msm: camera: utils: Fix OOB read due to wrong kmd cmd buffer index 



Add condition where kmd cmd buffer index is equal to number of
command buffers which may result in accessing memory out of bounds.

Change-Id: Iac73dae2b551ae93b9831514cfab8c0a5a1378b8
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
parent b0e2ff95

drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -109,7 +109,7 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet, 
	}

	}





	if ((packet->kmd_cmd_buf_index < 0) ||

	if ((packet->kmd_cmd_buf_index < 0) ||

		(packet->kmd_cmd_buf_index > packet->num_cmd_buf)) {

		(packet->kmd_cmd_buf_index >= packet->num_cmd_buf)) {

		CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",

		CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",

			packet->kmd_cmd_buf_index);

			packet->kmd_cmd_buf_index);

		return -EINVAL;

		return -EINVAL;