evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: eeprom: Validate the power setting size

Browse source 
Validate the power setting size before copying.
If userspace sends a value which is greater than
MAX_POWER_CONFIG, then the driver accesses unintended memory.
This change will fix the issue.

Crs-Fixed: 1089433
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
Change-Id: Iaaa6f5b3c1c2ac5b5b38b3ac407d6ae394bba780
This commit is contained in:
Rajesh Bondugula 2016-11-29 16:27:12 -08:00
parent cd316285c5
commit 9868ace0ab
1 changed files with 10 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c
View file

@ -1400,6 +1400,16 @@ static int eeprom_init_config32(struct msm_eeprom_ctrl_t *e_ctrl,
power_info = &(e_ctrl->eboard_info->power_info);
if ((power_setting_array32->size > MAX_POWER_CONFIG) ||
(power_setting_array32->size_down > MAX_POWER_CONFIG) ||
(!power_setting_array32->size) ||
(!power_setting_array32->size_down)) {
pr_err("%s:%d invalid power setting size=%d size_down=%d\n",
__func__, __LINE__, power_setting_array32->size,
power_setting_array32->size_down);
rc = -EINVAL;
goto free_mem;
}
msm_eeprom_copy_power_settings_compat(
power_setting_array,
power_setting_array32);
@ -1414,20 +1424,6 @@ static int eeprom_init_config32(struct msm_eeprom_ctrl_t *e_ctrl,
power_info->power_down_setting_size =
power_setting_array->size_down;
if ((power_info->power_setting_size >
MAX_POWER_CONFIG) ||
(power_info->power_down_setting_size >
MAX_POWER_CONFIG) ||
(!power_info->power_down_setting_size) ||
(!power_info->power_setting_size)) {
rc = -EINVAL;
pr_err("%s:%d Invalid power setting size :%d, %d\n",
__func__, __LINE__,
power_info->power_setting_size,
power_info->power_down_setting_size);
goto free_mem;
}
if (e_ctrl->i2c_client.cci_client) {
e_ctrl->i2c_client.cci_client->i2c_freq_mode =
cdata32->cfg.eeprom_info.i2c_freq_mode;