samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: sensor: Offset Validation before dereferencing

Browse Source 
- Validation of settings_array_offset which is populated
  from umd as sizeof(CSLTPGSettingsConfigCmd).

CRs-Fixed: 3788500
Change-Id: Ic848d537f1b56bcfc47b295b063e9670313c9a33
Signed-off-by: Abhilash Mahapatra <quic_abhmah@quicinc.com>
This commit is contained in:
Abhilash Mahapatra
2024-04-02 00:14:13 +05:30
parent 4408d24dab
commit b321b9ac17
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/cam_sensor_module/cam_tpg/tpg_hw/tpg_hw.c
View File

@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only // SPDX-License-Identifier: GPL-2.0-only
/* /*
* Copyright (c) 2021, The Linux Foundation. All rights reserved. * Copyright (c) 2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved. * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
*/ */
#include "tpg_hw.h" #include "tpg_hw.h"
@@ -1086,6 +1086,12 @@ int tpg_hw_copy_settings_config(
return -EINVAL; return -EINVAL;
} }
if (settings->settings_array_offset >
sizeof(struct tpg_settings_config_t)) {
CAM_ERR(CAM_TPG, "Invalid Array Offset");
return -EINVAL;
}
reg_settings = (struct tpg_reg_settings *) reg_settings = (struct tpg_reg_settings *)
((uint8_t *)settings + settings->settings_array_offset); ((uint8_t *)settings + settings->settings_array_offset);