Browse Source

msm: camera: jpeg: Fix potential OOB access

This change fixes a potential OOB access issue due to
culprit checking.

CRs-Fixed: 3851339
Change-Id: I5a8b8977f815376eeb41a4a227df6e307c7bd99d
Signed-off-by: Haochen Yang <[email protected]>
Haochen Yang 1 year ago
parent
commit
37c2bd7cb9
1 changed files with 1 additions and 1 deletions
  1. 1 1
      drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

+ 1 - 1
drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

@@ -202,7 +202,7 @@ static int cam_jpeg_add_command_buffers(struct cam_packet *packet,
 
 			cmd_buf_kaddr = (uint32_t *)kaddr;
 
-			if ((cmd_desc[i].offset / sizeof(uint32_t)) >= len) {
+			if (cmd_desc[i].offset >= len) {
 				CAM_ERR(CAM_JPEG, "Invalid offset: %u cmd buf len: %zu",
 					cmd_desc[i].offset, len);
 				cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);