evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: sensor: actuator: fix out of bound read for bivcm region params

Browse source 
The region index for bivcm is not validated against the region size.
This causes out-of-bound read on the KASAN kernel.
Add restriction that region index smaller than region size.

CRs-Fixed: 2379514
Change-Id: I72c4a41a4b41c8fa70c174ffd3215a81eaa14355
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
This commit is contained in:
Haibin Liu 2019-04-30 14:16:47 +08:00 • committed by Gerrit - the friendly Code Review server
parent a19883a728
commit 1656e2e44d
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. /* Copyright (c) 2011-2019, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -768,6 +768,9 @@ static int32_t msm_actuator_bivcm_move_focus(
a_ctrl->curr_step_pos, dest_step_pos, curr_lens_pos); a_ctrl->curr_step_pos, dest_step_pos, curr_lens_pos);
while (a_ctrl->curr_step_pos != dest_step_pos) { while (a_ctrl->curr_step_pos != dest_step_pos) {
if (a_ctrl->curr_region_index >= a_ctrl->region_size)
break;
step_boundary = step_boundary =
a_ctrl->region_params[a_ctrl->curr_region_index]. a_ctrl->region_params[a_ctrl->curr_region_index].
step_bound[dir]; step_bound[dir];