evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: fix bound check of offset to avoid overread overwrite

Browse source 
fix bound check of hw_cmd_p->offset in msm_jpeg_hw_exec_cmds
to avoid overread overwrite.

CRs-Fixed: 1088824

Change-Id: Ifaa4b5387d4285ddce16d8e745aa0500c64c568b
Signed-off-by: Krishnankutty Kolathappilly <kkolatha@codeaurora.org>
This commit is contained in:
Krishnankutty Kolathappilly 2016-11-14 18:46:12 -08:00
parent 4a91ea36cb
commit 2dab9de1da
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c
View file

@ -847,7 +847,7 @@ int msm_jpeg_hw_exec_cmds(struct msm_jpeg_hw_cmd *hw_cmd_p, uint32_t m_cmds,
uint32_t data;
while (m_cmds--) {
if (hw_cmd_p->offset > max_size) {
if (hw_cmd_p->offset >= max_size) {
JPEG_PR_ERR("%s:%d] %d exceed hw region %d\n", __func__,
__LINE__, hw_cmd_p->offset, max_size);
return -EFAULT;