msm: camera: jpeg: Fix potential OOB access

This change fixes a potential OOB access issue due to
culprit checking.

CRs-Fixed: 3851339
Change-Id: I5a8b8977f815376eeb41a4a227df6e307c7bd99d
Signed-off-by: Haochen Yang <quic_haocyang@quicinc.com>
This commit is contained in:
Haochen Yang
2024-06-27 17:14:22 -07:00
committed by Sridhar Gujje
父節點 6ddbe8dd37
當前提交 37c2bd7cb9

查看文件

@@ -202,7 +202,7 @@ static int cam_jpeg_add_command_buffers(struct cam_packet *packet,
cmd_buf_kaddr = (uint32_t *)kaddr; cmd_buf_kaddr = (uint32_t *)kaddr;
if ((cmd_desc[i].offset / sizeof(uint32_t)) >= len) { if (cmd_desc[i].offset >= len) {
CAM_ERR(CAM_JPEG, "Invalid offset: %u cmd buf len: %zu", CAM_ERR(CAM_JPEG, "Invalid offset: %u cmd buf len: %zu",
cmd_desc[i].offset, len); cmd_desc[i].offset, len);
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);