lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: eeprom: Fix OOB condition for memory map count

Browse Source 
Fix OOB check for memory map count to access correct memory map.

Change-Id: Ifa3d323103725e4df57e86295bb7567835654b71
Signed-off-by: Jigarkumar Zala <jzala@codeaurora.org>
This commit is contained in:
Jigarkumar Zala 2019-05-29 10:24:40 -07:00 committed by Gerrit - the friendly Code Review server
parent a52b95db19
commit 146826aa41
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
View File

@ -435,7 +435,8 @@ static int32_t cam_eeprom_parse_memory_map(
validate_size = sizeof(struct cam_cmd_unconditional_wait);
if (remain_buf_len < validate_size ||
*num_map >= MSM_EEPROM_MAX_MEM_MAP_CNT) {
*num_map >= (MSM_EEPROM_MAX_MEM_MAP_CNT *
MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) {
CAM_ERR(CAM_EEPROM, "not enough buffer");
return -EINVAL;
}
@ -445,7 +446,9 @@ static int32_t cam_eeprom_parse_memory_map(
if (i2c_random_wr->header.count == 0 ||
i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT ||
(size_t)*num_map > U16_MAX - i2c_random_wr->header.count) {
(size_t)*num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT *
MSM_EEPROM_MEMORY_MAP_MAX_SIZE) -
i2c_random_wr->header.count)) {
CAM_ERR(CAM_EEPROM, "OOB Error");
return -EINVAL;
}