msm: camera: jpeg: Fix potential OOB access
This change fixes a potential OOB access issue due to culprit checking. CRs-Fixed: 3851339 Change-Id: I5a8b8977f815376eeb41a4a227df6e307c7bd99d Signed-off-by: Haochen Yang <quic_haocyang@quicinc.com>
This commit is contained in:
@@ -202,7 +202,7 @@ static int cam_jpeg_add_command_buffers(struct cam_packet *packet,
|
|||||||
|
|
||||||
cmd_buf_kaddr = (uint32_t *)kaddr;
|
cmd_buf_kaddr = (uint32_t *)kaddr;
|
||||||
|
|
||||||
if ((cmd_desc[i].offset / sizeof(uint32_t)) >= len) {
|
if (cmd_desc[i].offset >= len) {
|
||||||
CAM_ERR(CAM_JPEG, "Invalid offset: %u cmd buf len: %zu",
|
CAM_ERR(CAM_JPEG, "Invalid offset: %u cmd buf len: %zu",
|
||||||
cmd_desc[i].offset, len);
|
cmd_desc[i].offset, len);
|
||||||
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
|
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
|
||||||
|
Reference in New Issue
Block a user