lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: ife: Add ife num outport bound checks

Browse Source 
Variable num_ports is provided by userspace, it it used to index
res_list_isp_out. Big num_ports value can cause out of bound read.

Bound check num_ports, to prevent OOB read.

CRs-Fixed: 3056360
Change-Id: I86b6cf0419c68af1f510ce166e4964e177367eaf
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
This commit is contained in:
Trishansh Bhardwaj 2021-07-30 05:22:31 +00:00
parent 981b2405f2
commit 45dbb6c0cd
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
View File

@ -124,6 +124,12 @@ static int cam_isp_update_dual_config(
cpu_addr += (cmd_desc->offset / 4); cpu_addr += (cmd_desc->offset / 4);
dual_config = (struct cam_isp_dual_config *)cpu_addr; dual_config = (struct cam_isp_dual_config *)cpu_addr;
if (dual_config->num_ports > size_isp_out) {
CAM_ERR(CAM_ISP, "num_ports %d more than max_vfe_out_res %d",
dual_config->num_ports, size_isp_out);
return -EINVAL;
}
if ((dual_config->num_ports * if ((dual_config->num_ports *
sizeof(struct cam_isp_dual_stripe_config)) > sizeof(struct cam_isp_dual_stripe_config)) >
(remain_len - offsetof(struct cam_isp_dual_config, stripes))) { (remain_len - offsetof(struct cam_isp_dual_config, stripes))) {
@ -132,14 +138,6 @@ static int cam_isp_update_dual_config(
} }
for (i = 0; i < dual_config->num_ports; i++) { for (i = 0; i < dual_config->num_ports; i++) {
if (i >= CAM_ISP_IFE_OUT_RES_BASE + size_isp_out) {
CAM_ERR(CAM_ISP,
"failed update for i:%d > size_isp_out:%d",
i, size_isp_out);
rc = -EINVAL;
goto end;
}
hw_mgr_res = &res_list_isp_out[i]; hw_mgr_res = &res_list_isp_out[i];
if (!hw_mgr_res) { if (!hw_mgr_res) {
CAM_ERR(CAM_ISP, CAM_ERR(CAM_ISP,