mirror/android_kernel_moto_shamu
3
0
Fork 0
mirror of https://github.com/LineageOS/android_kernel_moto_shamu.git synced 2026-04-02 05:40:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

msm: camera: isp: Validate reg_offset and len parameters

Browse Source 
Validate reg_offset and len parameters before consuming to
avoid invalid register access.

Bug: 19141654
Change-Id: I07676a6d10a9945fb0b99ebfd147075f896fbfab
Signed-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
Signed-off-by: Patrick Tjin <pattjin@google.com>
This commit is contained in:
Sreesudhan Ramakrish Ramkumar
2014-12-08 11:28:17 -08:00
committed by Pat Tjin
parent 5d5e481f2b
commit c8b20be3e5
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
View File

@ -525,6 +525,20 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev,
}
switch (reg_cfg_cmd->cmd_type) {
case VFE_WRITE: {
if (reg_cfg_cmd->u.rw_info.reg_offset <
resource_size(vfe_dev->vfe_mem)) {
uint32_t diff = 0;
diff = resource_size(vfe_dev->vfe_mem) -
reg_cfg_cmd->u.rw_info.reg_offset;
if (diff < reg_cfg_cmd->u.rw_info.len) {
pr_err("%s: VFE_WRITE: Invalid length\n",
__func__);
return -EINVAL;
}
} else {
pr_err("%s: VFE_WRITE: Invalid length\n", __func__);
return -EINVAL;
}
if (resource_size(vfe_dev->vfe_mem) <
(reg_cfg_cmd->u.rw_info.reg_offset +
reg_cfg_cmd->u.rw_info.len)) {