evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ais: fix off-by-one overflow in msm_isp_get_bufq

Browse source 
In msm_isp_get_bufq, if bufq_index == buf_mgr->num_buf_q,
it will pass the check, leading to off-by-one overflow
(exceed the length of array by one element).

Change-Id: Iccf02b68314e770ad9fae41973cad6ff7700b822
Signed-off-by: E V Ravi <evenka@codeaurora.org>
This commit is contained in:
E V Ravi 2018-11-16 18:07:51 +05:30
parent 23d37eecf8
commit 77d8951c4e
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/media/platform/msm/ais/isp/msm_buf_mgr.c
View file

@ -86,7 +86,7 @@ static struct msm_isp_bufq *msm_isp_get_bufq(
/* bufq_handle cannot be 0 */
if ((bufq_handle == 0) ||
bufq_index >= BUF_MGR_NUM_BUF_Q ||
(bufq_index > buf_mgr->num_buf_q))
(bufq_index >= buf_mgr->num_buf_q))
return NULL;
bufq = &buf_mgr->bufq[bufq_index];