evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: sensor: validate the i2c table index before use

Browse source 
Verifying the i2c table index value before accessing
the i2c table to avoid memory corruption issues.

CRs-Fixed: 1065916
Change-Id: I0e31c22f90006f27a77cd420288334b8355cee95
Signed-off-by: Sureshnaidu Laveti <lsuresh@codeaurora.org>
This commit is contained in:
Sureshnaidu Laveti 2016-09-14 07:03:44 -07:00 • committed by Gerrit - the friendly Code Review server
parent 626caf4e54
commit f1e5322784
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
View file

@ -101,11 +101,6 @@ static void msm_actuator_parse_i2c_params(struct msm_actuator_ctrl_t *a_ctrl,
i2c_tbl = a_ctrl->i2c_reg_tbl;
for (i = 0; i < size; i++) {
/* check that the index into i2c_tbl cannot grow larger that
the allocated size of i2c_tbl */
if ((a_ctrl->total_steps + 1) < (a_ctrl->i2c_tbl_index))
break;
if (write_arr[i].reg_write_type == MSM_ACTUATOR_WRITE_DAC) {
value = (next_lens_position <<
write_arr[i].data_shift) |
@ -119,6 +114,11 @@ static void msm_actuator_parse_i2c_params(struct msm_actuator_ctrl_t *a_ctrl,
i2c_byte2 = value & 0xFF;
CDBG("byte1:0x%x, byte2:0x%x\n",
i2c_byte1, i2c_byte2);
if (a_ctrl->i2c_tbl_index >
a_ctrl->total_steps) {
pr_err("failed:i2c table index out of bound\n");
break;
}
i2c_tbl[a_ctrl->i2c_tbl_index].
reg_addr = i2c_byte1;
i2c_tbl[a_ctrl->i2c_tbl_index].
@ -139,6 +139,10 @@ static void msm_actuator_parse_i2c_params(struct msm_actuator_ctrl_t *a_ctrl,
i2c_byte2 = (hw_dword & write_arr[i].hw_mask) >>
write_arr[i].hw_shift;
}
if (a_ctrl->i2c_tbl_index > a_ctrl->total_steps) {
pr_err("failed: i2c table index out of bound\n");
break;
}
CDBG("i2c_byte1:0x%x, i2c_byte2:0x%x\n", i2c_byte1, i2c_byte2);
i2c_tbl[a_ctrl->i2c_tbl_index].reg_addr = i2c_byte1;
i2c_tbl[a_ctrl->i2c_tbl_index].reg_data = i2c_byte2;