evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ais: Bound check for num_of_stream

Browse source 
- num of stream comes from userspace and used without
any bound check.It may result to overflow update_info.

Change-Id: I67341f3c3e1a3384474c35f6e6275d6e1917fdcd
CRs-Fixed: 2006829
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
This commit is contained in:
Rahul Sharma 2017-08-02 14:07:43 +05:30 • committed by Gerrit - the friendly Code Review server
parent e29d253ecf
commit 79db0d1523
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c
View file

@ -891,6 +891,12 @@ int msm_isp_update_stats_stream(struct vfe_device *vfe_dev, void *arg)
struct msm_vfe_axi_stream_cfg_update_info *update_info = NULL;
struct msm_isp_sw_framskip *sw_skip_info = NULL;
if (update_cmd->num_streams > MSM_ISP_STATS_MAX) {
pr_err("%s: Invalid num_streams %d\n",
__func__, update_cmd->num_streams);
return -EINVAL;
}
/* validate request */
for (i = 0; i < update_cmd->num_streams; i++) {
update_info = (struct msm_vfe_axi_stream_cfg_update_info *)