Merge "msm: camera: check size of allocated buffer to prevent overflow" (0e34590a) · Commits · e / devices / samsung / android_kernel_samsung_msm8916

drivers/media/platform/msm/camera_v2/sensor/mt9m114.c

+17 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -1267,6 +1267,14 @@ int32_t mt9m114_sensor_config(struct msm_sensor_ctrl_t *s_ctrl,
		break;
		}

		if (!conf_array.size \|\|
		conf_array.size > I2C_SEQ_REG_DATA_MAX) {

		pr_err("%s:%d failed\n", __func__, __LINE__);
		rc = -EFAULT;
		break;
		}

		reg_setting = kzalloc(conf_array.size *
		(sizeof(struct msm_camera_i2c_reg_array)), GFP_KERNEL);
		if (!reg_setting) {
		@@ -1502,6 +1510,14 @@ int32_t mt9m114_sensor_config32(struct msm_sensor_ctrl_t *s_ctrl,
		conf_array.size = conf_array32.size;
		conf_array.reg_setting = compat_ptr(conf_array32.reg_setting);

		if (!conf_array.size \|\|
		conf_array.size > I2C_SEQ_REG_DATA_MAX) {

		pr_err("%s:%d failed\n", __func__, __LINE__);
		rc = -EFAULT;
		break;
		}

		reg_setting = kzalloc(conf_array.size *
		(sizeof(struct msm_camera_i2c_reg_array)), GFP_KERNEL);
		if (!reg_setting) {