evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: camera: Proper use of snprintf to avoid information leak"

Browse source
This commit is contained in:
Linux Build Service Account 2017-07-21 11:08:25 -07:00 • committed by Gerrit - the friendly Code Review server
commit 5b779ed898
1 changed files with 27 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -903,26 +903,45 @@ int msm_jpeg_hw_exec_cmds(struct msm_jpeg_hw_cmd *hw_cmd_p, uint32_t m_cmds,
void msm_jpeg_io_dump(void *base, int size)
{
char line_str[128], *p_str;
char line_str[128];
void __iomem *addr = (void __iomem *)base;
int i;
u32 *p = (u32 *) addr;
size_t offset = 0;
size_t used = 0;
size_t min_range = 0;
size_t sizeof_line_str = sizeof(line_str);
u32 data;
JPEG_DBG_HIGH("%s:%d] %pK %d", __func__, __LINE__, addr, size);
line_str[0] = '\0';
p_str = line_str;
for (i = 0; i < size/4; i++) {
if (i % 4 == 0) {
snprintf(p_str, 12, "%08lx: ", (unsigned long)p);
p_str += 10;
used = snprintf(line_str + offset,
sizeof_line_str - offset, "%pK ", p);
if ((used < min_range) ||
(offset + used >= sizeof_line_str)) {
JPEG_PR_ERR("%s\n", line_str);
offset = 0;
line_str[0] = '\0';
} else {
offset += used;
}
}
data = msm_camera_io_r(p++);
snprintf(p_str, 12, "%08x ", data);
p_str += 9;
used = snprintf(line_str + offset,
sizeof_line_str - offset, "%08x ", data);
if ((used < min_range) ||
(offset + used >= sizeof_line_str)) {
JPEG_PR_ERR("%s\n", line_str);
offset = 0;
line_str[0] = '\0';
} else {
offset += used;
}
if ((i + 1) % 4 == 0) {
JPEG_DBG_HIGH("%s\n", line_str);
line_str[0] = '\0';
p_str = line_str;
offset = 0;
}
}
if (line_str[0] != '\0')