samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

video: driver: fix stack stack-out-of-bounds issue

Browse Source 
In msm_vidc_packetize_control api, there is a stack-out-of-bounds
possibility. So added change to fix this issue.

Change-Id: I9c9a0217b55dd2586cfd6f814401c80ddb0c011f
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
This commit is contained in:
Govindaraj Rajagopal
2021-08-04 13:13:02 +05:30
parent cff24b925c
commit c24d458399
1 changed files with 24 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
driver/vidc/src/msm_vidc_control.c
View File

@@ -177,11 +177,25 @@ static int msm_vidc_packetize_control(struct msm_vidc_inst *inst,
void *hfi_val, u32 payload_size, const char *func) void *hfi_val, u32 payload_size, const char *func)
{ {
int rc = 0; int rc = 0;
u64 payload = 0;
i_vpr_h(inst, if (payload_size == sizeof(u32))
"set cap: name: %24s, cap value: %#10x, hfi: %#10x\n", payload = *(u32 *)hfi_val;
cap_name(cap_id), inst->capabilities->cap[cap_id].value, else if (payload_size == sizeof(u64))
*(s64 *)hfi_val); payload = *(u64 *)hfi_val;
else if (payload_size == sizeof(u8))
payload = *(u8 *)hfi_val;
else if (payload_size == sizeof(u16))
payload = *(u16 *)hfi_val;
if (payload_size <= sizeof(u64))
i_vpr_h(inst,
"set cap: name: %24s, cap value: %#10x, hfi: %#10x\n",
cap_name(cap_id), inst->capabilities->cap[cap_id].value, payload);
else
i_vpr_h(inst,
"set cap: name: %24s, hfi payload size %d\n",
cap_name(cap_id), payload_size);
rc = venus_hfi_session_property(inst, rc = venus_hfi_session_property(inst,
inst->capabilities->cap[cap_id].hfi_id, inst->capabilities->cap[cap_id].hfi_id,
@@ -189,13 +203,14 @@ static int msm_vidc_packetize_control(struct msm_vidc_inst *inst,
msm_vidc_get_port_info(inst, cap_id), msm_vidc_get_port_info(inst, cap_id),
payload_type, payload_type,
hfi_val, hfi_val,
sizeof(payload_size)); payload_size);
if (rc) if (rc) {
i_vpr_e(inst, i_vpr_e(inst, "%s: failed to set cap[%d] %s to fw\n",
"%s: failed to set cap[%d] %s to fw\n",
__func__, cap_id, cap_name(cap_id)); __func__, cap_id, cap_name(cap_id));
return rc;
}
return rc; return 0;
} }
static enum msm_vidc_inst_capability_type msm_vidc_get_cap_id( static enum msm_vidc_inst_capability_type msm_vidc_get_cap_id(