OSDN Git Service

msm: camera: isp: add bound check to handle array out of access
authorSenthil Kumar Rajagopal <skrajago@codeaurora.org>
Mon, 10 Apr 2017 09:41:14 +0000 (15:11 +0530)
committerSenthil Kumar Rajagopal <skrajago@codeaurora.org>
Tue, 18 Apr 2017 09:46:51 +0000 (15:16 +0530)
commitfd70b655d901e626403f132b65fc03d993f0a09b
tree3d6ae1c18e38820d98678907ebd6ff24bca70982
parent7f0d77b390e15aa9ea4b517aec21a0e88e02f5a0
msm: camera: isp: add bound check to handle array out of access

The pointer req_frm comes from userspace,
req_frm->stream_handle is passed as an argument to
the function msm_isp_get_stream_common_data,
stream_idx can overflow common_data->streams[] and
the code ends up copying an out of bound
kernel address into stream_info. Adding bound check to
handle the same.

CRs-fixed: 2008683
Change-Id: Ib4a059bfd573cdc4e18ce630b4091576ff8edc7e
Signed-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>
drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.h