samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: jpeg: Ensure in/out map entries are within allowed range

Browse Source 
Added checks to make sure in_map /out_map entries of
packet io configs are within expected maximum value.

CRs-Fixed: 3007258
Change-Id: I7e5a652cd8f9ae104a10a2af551fe49930849b2d
Signed-off-by: Shravya Samala <shravyas@codeaurora.org>
This commit is contained in:
Shravya Samala
2021-09-06 21:12:00 +05:30
parent d7eb296004
commit b281d0d19c
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
View File

@@ -943,11 +943,13 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
return rc; return rc;
} }
if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) || !packet->num_patches || if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) ||
!packet->num_io_configs) { !packet->num_patches || !packet->num_io_configs ||
CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u", (packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
packet->num_cmd_buf, CAM_ERR(CAM_JPEG,
packet->num_patches); "wrong number of cmd/patch/io_configs info: %u %u %u",
packet->num_cmd_buf, packet->num_patches,
packet->num_io_configs);
return -EINVAL; return -EINVAL;
} }

2
include/uapi/camera/media/cam_jpeg.h
View File

@@ -36,6 +36,8 @@
#define CAM_JPEG_DMA_OUTPUT_IMAGE 0x1 #define CAM_JPEG_DMA_OUTPUT_IMAGE 0x1
#define CAM_JPEG_DMA_IO_IMAGES_MAX 0x2 #define CAM_JPEG_DMA_IO_IMAGES_MAX 0x2
#define CAM_JPEG_IMAGE_MAX 0x2
/*JPEG Command Buffer Metadata types*/ /*JPEG Command Buffer Metadata types*/
#define CAM_JPEG_ENC_PACKET_CONFIG_DATA 0x00 #define CAM_JPEG_ENC_PACKET_CONFIG_DATA 0x00
#define CAM_JPEG_DMA_PACKET_PLANE0_CONFIG_DATA 0x01 #define CAM_JPEG_DMA_PACKET_PLANE0_CONFIG_DATA 0x01