Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db7c03f4 authored by Gaoxiang Chen's avatar Gaoxiang Chen Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: don't cut to 8bits for validating enum variable 



In msm_ispif_is_intf_valid(),
we convert a enum variable msm_ispif_vfe_intf,
to uint8_t type for validating.

This could cause potential issue,
if the value is crafted in such a way that lower 8bits pass the validation.

Don't use uint8_t as input parm to avoid such vulnerability.

CRs-Fixed: 2008469
Change-Id: I4ee400ac0edd830decfbe5712966d968976a268a
Signed-off-by: default avatarGaoxiang Chen <gaochen@codeaurora.org>
parent caf88f5a

drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c

+6 −6
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ static void msm_ispif_io_dump_reg(struct ispif_device *ispif) 




static inline int msm_ispif_is_intf_valid(uint32_t csid_version,

	uint8_t intf_type)

	enum msm_ispif_vfe_intf intf_type)

{

        return ((csid_version <= CSID_VERSION_V22 && intf_type != VFE0) ||

                (intf_type >= VFE_MAX)) ? false : true;
@@ -349,7 +349,7 @@ static int msm_ispif_subdev_g_chip_ident(struct v4l2_subdev *sd, 
}



static void msm_ispif_sel_csid_core(struct ispif_device *ispif,

	uint8_t intftype, uint8_t csid, uint8_t vfe_intf)

	uint8_t intftype, uint8_t csid, enum msm_ispif_vfe_intf vfe_intf)

{

	uint32_t data;
@@ -389,7 +389,7 @@ static void msm_ispif_sel_csid_core(struct ispif_device *ispif, 
}



static void msm_ispif_enable_crop(struct ispif_device *ispif,

	uint8_t intftype, uint8_t vfe_intf, uint16_t start_pixel,

	uint8_t intftype, enum msm_ispif_vfe_intf vfe_intf, uint16_t start_pixel,

	uint16_t end_pixel)

{

	uint32_t data;
@@ -421,7 +421,7 @@ static void msm_ispif_enable_crop(struct ispif_device *ispif, 
}



static void msm_ispif_enable_intf_cids(struct ispif_device *ispif,

	uint8_t intftype, uint16_t cid_mask, uint8_t vfe_intf, uint8_t enable)

	uint8_t intftype, uint16_t cid_mask, enum msm_ispif_vfe_intf vfe_intf, uint8_t enable)

{

	uint32_t intf_addr, data;
@@ -463,7 +463,7 @@ static void msm_ispif_enable_intf_cids(struct ispif_device *ispif, 
}



static int msm_ispif_validate_intf_status(struct ispif_device *ispif,

	uint8_t intftype, uint8_t vfe_intf)

	uint8_t intftype, enum msm_ispif_vfe_intf vfe_intf)

{

	int rc = 0;

	uint32_t data = 0;
@@ -503,7 +503,7 @@ static int msm_ispif_validate_intf_status(struct ispif_device *ispif, 
}



static void msm_ispif_select_clk_mux(struct ispif_device *ispif,

	uint8_t intftype, uint8_t csid, uint8_t vfe_intf)

	uint8_t intftype, uint8_t csid, enum msm_ispif_vfe_intf vfe_intf)

{

	uint32_t data = 0;